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FOREWORD 


This document represents the final report to the National Aeronautics and 
Space Administration for work performed under Task Order E.3 to contract NAS 3- 
23772. The task work span was from June 1986 through May 1987. This task 
addressed the Integrated Control and Health Management (ICHM) technology 
requirements for the Orbit Transfer Rocket Engine Technology Program. This is a 
summary report in that all material discussed herein was presented to NASA 
program personnel at oral presentations or in the contractually required monthly 
progress reports during active work on the task. 

The principal investigator. Dr. Joseph Yang, was unable to complete the report 
due to reassignment. The report authors assumed the report preparation task after 
the actual analysis effort was complete. The authors also wish to acknowledge the 
assistance of Edward M. Reich and Duncan D. MacGregor in the conduct of the 
ICHM task, in the oral presentations given during its course, and in review and 
comments during the report preparation. 
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I. 


SUMMARY 


When this engine control and health management task was approved engine 
designs for the Orbit Transfer Vehicle (OTV) had progressed to a point where a con- 
trol assessment was necessary for confidence that the proposed expander cycle was 
practical. The oxygen and hydrogen turbopumps are mechanically separate, flow 
circuits are complicated, and numerous valves are required for these complex 
engines. Resources limited the scope of the work to developing a nonlinear 
dynamic model, but simulations with the model predict full range throttling, thrust, 
and mixture ratio control with the baseline engine controls. This success is an 
important validation of the engine design approach and encourages continued 
engine development. Additional work is needed, however, prior to full-scale engi- 
neering development to verify the linear dynamic model and to map the complete 
engine control range. 


The second major task was to integrate the controls approach with a health 
management system. An integrated systems approach had been recommended by 
ATC and approved by the NASA as a means of reducing sensor numbers and data 
streams. The health management system also directly affects engine life and mis- 
sion success, both important design considerations for the engine. It will also be 
used for pre- and post-flight health assessment. During the mission it will com- 
mand the controller to prevent equipment damage or a catastrophic failure; very 
important functions for a piloted vehicle. The study produced a basic health man- 
agement architecture fully integrated with the engine control function. Specific 
sensors were identified and simplified specifications developed for both sensors and 
the most import mechanical control elements, the valves. Enough of the 
groundwork has been completed to define the software development task that 
would make the system operational. 


A major unknown in the integrated control and health management (ICHM) 
task was the amount of development work needed for the engine controller. This 
had been considered a $5 to 10M project based on the system complexity if a con- 
troller had to be specifically designed for this engine. Aerojet was able to verify that 
a new controller developed for pump-fed storable propellant engines could be 
modified to meet the OTV engine requirements. With a controller indentified all 
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I, Summary (cont.) 


of the basic control and sensor hardware is either available or in the active develop- 
ment cycle. This assures that the ICHM requirements of the engine can be meet 
within any reasonable development schedule. 

The next requirement for additional ICHM development will come in the 
preparation for a test bed or integrated component test program. Actual sensors and 
control valves will be used with software developed for a specific test site but repre- 
sentative of that needed for the engine controller. This report is the logical starting 
point for that phase of the engine development. 
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II. INTRODUCTION 


A. BACKGROUND 

1. En gine Control and Health Monitor Sensor Capability 

Aerojet has investigated engine control requirements for the Orbit 
Transfer Vehicle Engine under NASA contracts going back to 1979 (NAS8-33574, see 
ref. 1). The present contract, however, departs from the former program direction by 
changing the emphasis from a strictly engine control investigation to an integration 
of engine control with engine health management. The health monitoring tech- 
nology focus' of present NASA interest is in sensor development. Aerojet 
TechSystems Co. (ATC) shares this interest and believes that a comprehensive 
health management system is limited primarily by the availability of suitable 
sensors. Fortunately, much new sensor technology is being developed for 
automotive, industrial and aerospace applications. ATC believes that much of this 
new technology is applicable to rocket engines and can and should be adapted to 
programs such as OTV. The ATC approach to sensor development is to search out 
the best available technology for the specific application, modify and adapt it as 
required, and team with the most qualified vendor for its development. 

2. Aerojet Approach to the ICHM Task 

A summary chart of ATC’s approach to the ICHM task is given in 
Figure 1. The NASA has accepted this approach to the extent that this preliminary 
ICHM task is largely concerned with the OTV engine control’s development and 
modeling. With acceptable control analysis results obtained, the baselined control 
sensors can be used as a logical starting set for addressing health management sensor 
requirements. The necessary control and health management sensors have been 
identified, are listed in this report, and preliminary specifications have been pre- 
pared. In addition, ATC has investigated other aspects of sensor data use in the 
Orbit Transfer Vehicle as a means of deriving a basic design strategy for ICHM sen- 
sors that focuses on sensors having the greatest potential utility, not just those 
involving innovative sensing methods. Our basic design strategy is outlined in 
Figure 2. It is a conservative approach that is more concerned with extending the 
state-of-the-art rather than redefining it. The major benefits to be gained are high 
reliability and predictable sensor performance. A conservative approach to sensor 
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• ENGINE CONTROL MUST BE GIVEN FIRST PRIORITY DUE TO THE MISSION 
REQUIREMENTS AND UNIQUE DESIGN OF THE OTV ENGINE 

ENGINE CONTROL IS A CRITICAL TECHNOLOGY THAT MUST BE VALIDATED FOR 
ANY NEW ENGINE 

SYNCHRONIZED OPERATION OF MECHANICALLY SEPARATE TURBOPUMPS HAS 
BEEN DEMONSTRATED ONLY ON THE SSME 

CONTROL REQUIREMENTS FOR THROTTLING OPERATION AND MANRATING ARE 
PARTICULARLY DEMANDING 

DEFINITION OF CONTROL SENSORS IS A LOGICAL STARTING POINT FOR 
DEVELOPING SENSOR REQUIREMENTS FOR HEALTH MONITORING 

• TRANSITION FROM ENGINE CONTROL VALIDATION TO SENSOR DEVELOPMENT 

ATC CONSIDERS CONTROL STUDY RESULTS ACCEPTABLE BUT MORE WORK IS 
NEEDED 

HEALTH MANAGEMENT SENSOR DEVELOMENT IS CURRENT PROGRAM INTEREST 

CONTINUATION OF ENGINE CONTROL WORK SHOULD FOLLOW ENGINE 
PRELIMINARY DESIGN 

• SENSOR DATA MUST SATISFY USER REQUIREMENTS 

1 . ENGINE CONTROL - HIGHEST PRIORITY, GREATEST REDUNDANCY 

2. ENGINE HEALTH MONITORING - BOTH MISSION AND MAINTENANCE USE 

3. PILOT STATION DISPLAY - REAL TIME PROCESSED INFORMATION 

4. VEHICLE DATA TELEMETRY - REAL TIME DATA STREAM SELECTION 

• DESIGN FOR COST EFFECTIVENESS 

MULTIPLE USE OF SENSOR DATA WHEN POSSIBLE 

CRITICAL SENSOR TASKS REQUIRE REDUNDANCY OR INDIRECT DATA 
DERIVATION FROM OTHER SENSORS 

FMEA IDENTIFIES NEEDED SENSORS AND THE SENSOR RELIABILITY 
REQUIREMENTS 

SENSOR COST CAN BE A SIGNIFICANT PART OF TOTAL ENGINE COSTS 

NEW SENSORS CAN HAVE A DEVELOPMENT TIME MEASURED IN YEARS 

SENSOR INTERFACE/POWER/DISPLAY REQUIREMENTS EFFECT ENGINE AND 
VEHICLE DESIGN 


Figure 1. Aerojet's Approach to 1CHM 
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Use proven sensor designs when possible 
Miniaturize both electronics and transducers 
Consider that ruggedness and reliability tend to go together 
Require health management sensors for rotating parts 

• Vibration/out-of-balance indicators 

• Wear indicators 

• Seal failure indication 

• Rubbing /contact indicator for hydrostatic bearings 

Emphasize development of health management sensors used for maintenance 
decisions and system troubleshooting 

• Valve actuation rate sensing and recording 

• Leak and/or crack detection sensors 

• Temperature anomaly detection 

• Out-of-operating range excursions: temperature, mixture ratio, thrust, 
pressure sensing, recording and evaluating 

Sensors for operation record 

• Pc trace,flowmeter traces, turbine inlet temp, traces, engine compartment 
temp, trace, etc. 

• All data digitized and time correlated on recording 


Figure 2. Basic Design Strategy for ICHM Sensors 
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II, A, Background (cont.) 

development does not rule out innovation or free the development from chal- 
lenges. Figure 3 is a summary of the challenges perceived in sensor development 
for the OTV engine. ATC expects to propose an ICHM task to the NASA that 
addresses the serious computational and processing needs arising from the 
immense quantity of sensor data that will be available. An application from the 
rapidly developing field of expert systems and other artificial intelligence (AI) 
techniques is one likely possibility. 

3. Aerojet Dual Expander Eneine Cycle 

The ATC version of the OTV engine baselines a unique form of the 
expander cycle developed for high performance, turbopump-fed liquid propellant 
rocket engines. In a conventional hydrogen expander cycle the fuel is routed 
through the jacket of a regenera tively cooled engine where it acquires sufficient 
thermal energy to power the turbine drives of both fuel and oxidizer. The propel- 
lant then is routed to the injector and combustion chamber. This cycle is fairly sim- 
ple and offers good performance potential. As all the propellant is burned in the 
combustion chamber there are no losses comparable to those from open cycles. Its 
limitations are related to dependence on only one working fluid. High chamber 
pressures (>1500 psia) require high (>1000°F) hydrogen exit temperatures from the 
regen chamber. This poses limits to materials and cycle life concerns. The hydrogen 
working fluid must also drive pumps for both fuel and oxidizer. This requires an 
interpropellant seal in the oxygen pump or a gear drive. There are also mixture 
ratio limitations and demanding design requirements for needed heat transfer 
within an acceptable chamber length. 

The ATC dual expander cycle makes use of both fuel and oxidizer as 
working fluids. For the OTV engine the hydrogen fuel is used as the regen coolant 
for the combustion chamber jacket where it acquires sufficient energy to run the 
turbine driving the hydrogen turbopump before entering the injector. The engine 
concept used in the control study has an oxygen cooled nozzle extension with addi- 
tional oxygen heating from a LO 2 /GH 2 heat exchanger. The combined heat input 

raises the oxygen to 400°F. This is sufficient to drive the turbine on the oxygen tur- 
bopump but is considered a safe temperature for the turbine materials. 
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• CHARACTERIZE MOVING PARTS 

- RATES, NOT POSITION CHANGE ALONE 

- EXCURSION FROM SMOOTH, VIBRATION-FREE OPERATION 

- BEARING WEAR RATE AND LOCATION 

- UNUSUAL THERMAL GRADIENTS 

• MINIATURIZATION WITHOUT FRAGILITY 


- SENSORS BUILT INTO THE PART „ e 

FORMED IN TO DAMAGE RESISTANT SHAPES (SHORT, THICK VS. 

LONG, THIN) 

- WIRELESS DESIGNS WITHIN A COMPONENT 

- USE OF EQUIPMENT GENERATED SIGNALS (PASSIVE TRANSDUCER 
ELEMENTS) 

REDUCE COST, WEIGHT, POWER REQUIREMENTS 

- TRADE REDUNDANCY AND RELIABILITY 

- USE AI TO DEVELOP INFORMATION FROM OPERATING SYSTEMS 
WHEN THERE IS A FAILURE OF SOME SENSORS 

- SIGNAL PROCESSING BY MICROELECTRONICS AT THE SENSOR SITE 


Figure 3. Sensor Development Challenges 
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II, A, Background (cont.) 


By using both fuel and oxidizer as working fluids the dual expander 
cycle can deliver higher combustion chamber pressures at lower fluid temperatures 
than the conventional expander cycle. For throttling operation the mixture ratio 
limits are considerably broadened while maintaining close to optimum specific 
impulse. There is also a design and safety benefit from removing the need for an 
interpropellant seal from the oxygen turbopump. Of major importance at the sys- 
tem level is the capability to operate the engine without a helium purge system. 

This gives a major weight advantage to the cycle. 

4. Dual Expander Cycle Engine Control 

The OTV engine control schematic used for modeling is presented 
in Figure 4a. This control schematic was subsequently modified during the engine 
preliminary design task to the configuration shown in Figure 4b. Conceptually 
there is little difference between the two schematics but the changes in design details 
are substantial. The major change was to delete the oxygen cooled centerbody and 
provide oxygen heating by a LO 2 /GH 2 heat exchanger and the regen cooled nozzle 

extension. Also added were boost pumps and provisions for autogenous tank pres- 
surization. The major control concern is the mechanically separate turbopumps. 
Synchronization is absolutely dependent on sensor data properly interpreted and 
acted upon by the engine controller and control software. All engine operations are 
ultimately controlled by the 11 valves shown on the schematic in Figure 4b plus the 
two igniter valves. Valve control functions are listed in Table I along with the 
sensor data used to position the valves. The idle valve and back pressure valves are 
used only during startup and idle mode operation. The regenerator bypass valve 
and LO 2 /GH 2 heat exchanger valve are used for working fluid temperature control. 

The turbine bypass valves control thrust and mixture ratio. All valve sequencing 
and positioning is done through an electronic controller or through line pressure 
actuation. The controller, in turn, receives all the relevant sensor input as well as 
operation commands. This engine has a degree of complexity beyond the limits for 
a mechanical start and operating procedure; a controller is necessary to its operation. 

A direct spark ignition system was successfully tested in the ATC 
3.0K lbf thrust TCA hot-fire test program. It is the baseline ignition system for the 
engine. 
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Nominal Thrust = 3000 Ibf 
Max. Thrust = 3750 lbs 


Figure 4a. OTV Engine Control Schematic 
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Figure 4b. OTV Engine Dual Expander Cycle 
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TABLE I 

OTV-ENGINE VALVES AND SENSORS FOR ENGINE CONTROL 


Valve Name 

Abbreviation 

Control Function 

Primarv Sensor Data Source 

Hydrogen Turbine Bypass 

HTBV 

Mixture Ratio 

Hydrogen, Oxygen Flowmeters, 
Chamber Pressure 

Oxygen Turbine Bypass 

OTBV 

Thrust 

Flowmeters 

Oxygen Flowmeters, Hydrogen 

Heat Exchange Bypass 

HEB 

Oxygen Max. Temperature 

Oxygen Turbine Inlet Temperature 

Hydrogen Regenerator Bypass 

HRBV 

Hydrogen Max. 
Temperature 

Hydrogen Turbine Inlet 
Temperature 

Hydrogen Idle 

HIV 

Idle Mode Start 

Flowmeter Data, Chamber Pressure 

Hydrogen Back Pressure 

HBPV 

Start Pressure Balance 

Line Pressure Operated 

Oxygen Back Pressure 

OBPV 

Start Pressure Balance 

Line Pressure Operated 

Hydrogen Main Shutoff 

HMSV 

Propellant Isolation 

Commanded by OTV Pilot 
(Engine Start, Stop) or Engine 
Controller 

Oxygen Main Shutoff 

OMSV 

Propellant Isolation 

Commanded by OTV Pilot 
(Engine Start, Stop), or Engine 
Controller 

Hydrogen Igniter Control 

HICV 

Engine Start 

Chamber Pressure 

Oxygen Igniter Control 

OICV 

Engine Start 

Chamber Pressure 

Oxygen Tank Pressurization 

OTPV 

Tank Pressurization 

Tank Pressure, Chamber 
Pressure 

Hydrogen Tank Pressurization 

HTPV 

Tank Pressurization 

Tank Pressure, Chamber 
Pressure 



II, Intrcxiuction (cont.) 


B. SCOPE 

1. Task Order Scope Definition 

Provide the necessary personnel and support to continue the tech- 
nology development of a health management system for this OTV engine concept. 
Build on earlier work to improve the engine system model, evaluate the control 
logic, specify and determine the availability of control components and sensors, and 
integrate health management into the control system. 

2. Specific Subtasks 

Subtask I - Engine System Modeling 

Continue engine system dynamic modeling using the baseline 
engine system developed under previous contract efforts. An approach is to 
compile an initial model from simplified models of the primary engine 
components (i.e., TP As, thermal and combustion processes and control elements). 
Engine model sophistication is increased by including more detail for the individual 
component models. 

Update engine models, both dynamic and steady-state, as hardware 
test data becomes available or as control system changes are identified in Subtask II. 

Subtask II - Control Logic Evaluation 

Evaluate the preliminary control logic identified in earlier contract 
work using the engine system dynamic models developed in Subtask I. Perform 
control system stability analyses and determine system gains and shaping filter 
requirements for a stable, responsive system. Perform a controllability analysis to 
determine the engine and control system response during transient conditions such 
as start-up, shut-down and throttling. 
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II, B, Scope (cont.) 

Modify the control logic as necessary to achieve the desired system 
performance. Change the baseline control system if satisfactory performance cannot 
be achieved by adjusting the control logic algorithms. 

Subtask III - Control Element Requirements 

Establish control element requirements. Determine control valve 
parameters such as flow areas, resolution, accuracy, actuation method, valve type 
and operating environment. Identify control sensors required to implement the 
control system logic identified in Subtask II. Preliminary requirements for these 
sensors will be established. Determine basic engine controller requirements such as 
sensor processing, valve output drive capability, and computation and memory 
needs. For each of the control elements required to operate the engine, assess 
current and/or future component availability. 

Subtask IV - Health Monitoring 

Evaluate the baseline control system design so that 
an integrated control and health management design approach can be achieved. 

Key areas to be considered include sensors, computational requirements and algo- 
rithms. Emphasis is to be placed on the degree of health management that can be 
achieved using the control system sensors identified in Subtask III. Document the 
set of sensors, the parameters sensed or synthesized from this set, and the algo- 
rithms for synthesizing these parameters. The benefits of additional sensors to 
enhance health monitoring capabilities shall be considered. Review of prime con- 
tractor OTV studies so that the requirements for space-based repair/ maintenance, 
modularity or other appropriate factors, such as life cycle cost, are accounted for in 
the health monitor design. 
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IH. ENGINE SYSTEM MODELING 


A. CONTROL REQUIREMENTS 

A throttling range of 10:1 and mixture ratio variation of 5.0 to 7.0 over 
this range has been specified for the OTV engine. The nominal operating design 
point assumes a thrust of 7500 lbf and mixture ratio of 6.0. A dual expander engine 
cycle has the capability of meeting the throttling requirements within the limita- 
tions of the mixture ratio range. This is important in maintaining near optimal 
specific impulse from minimum to maximum thrust. A list of engine require- 
ments is given in Table II. 

B. CONTROL VALVES USED IN THE ENGINE MODEL 

Several control valve configurations were investigated in previous 
studies in order to determine their effect on engine control. This was achieved by 
using power balance models to determine the sensitivity of engine thrust and mix- 
ture ratio to valve perturbations. The in-line throttling concepts were determined 
to be unsuitable as they exhibited practically no control over mixture ratio. Analyti- 
cal results showed that bypass valves at the oxidizer and fuel turbines are effective 
in meeting the control objectives. Thrust control is provided by simultaneous 
modulation of the oxygen and hydrogen turbine bypass valves. Mixture ratio 
adjustments are made using the hydrogen turbine bypass valve. One of the impor- 
tant functions of the controller is to maintain stable engine operation. This would 
be impossible to achieve in an open-loop system due to the coupling between thrust 
and mixture ratio. 

C. MODEL BUILDING 

1. Dynamics Simulation Model 

The dynamics model shown in Figure 5 was used to study the tran- 
sient behavior of the engine system. TUTSIM®, a dynamics simulation package, 
was implemented for the actual model coding and simulation work. TUTSIM® is 
an acronym based on Twente University of Technology Simulation Software. It is a 
product of the software firm Applied I of Palo Alto, California. It was designed for 
use on the IBM PC/XT/AT/Jr computers. A number of configurations are available 


© = Copyright Cymbol 
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Table II 

OTV Engine Design Drivers 


Driver 

Measure ot Merit 

Goal/Requirement 

1. Performance 

Specific Impulse 

490 Seconds 

2. Weight 

Dry Weight of Deliverable Eng 

160 Ibm 

3 Cycle Lite 

^Starts, Hours ot Operation, 
Hot Gas Side Wall Temp., 
Operating Envelope 

100 Starts, 4 Hours Servlet 
500 Starts, 20 Hours Optra- 
tlonal Life 

4. Gimbai 

Pitch & Yaw Movement, 
Weight, Envelope 

± 20 Degrees 

5. Packaging 

Engine Length with Nozzle 
Stowed, Vehicle Interface 

TBD, Assume 60 Inches 

6. Combustion Stability 

Steady State Thrust Variation, 
Percent Over Operating Range 

Not Specified 

7. Thrust 

SEIements, Thrust/Element, 
Chamber Diameter 

7500 Ibf 

8. Throttling Rang* 

Nominal Thurst, Minimal Thrust, 
Control Complexity, 
Added Components 

10:1 

9. Spaca Based 

Vacuum Operation, No Purge 
Gaa Required 

No Change to Service Life 

10. Man-Rated 

Reliability V, Confidence Level, 
Control Complexity, 

Vahrf Design 

Fall Operational, Fall Safe 

11. Tank-HeadStart 

Reliable Starting on Tank 
Pressura 

NPSH: 15 ft-lbf/lbm for H 2 
2 ft-lbf/lbm for Oj 

12. Autogenous Pressurization 

TPA Output Sufficient to Pressurize 
Propellant Tanks above Cavitation 
Minimum Pressure 

TBD, Assume 25 psta, ± 5 psl 




Figure 5. Engine Dynamic Simulation 
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Ill, C, Model Building (cont.) 

including a professional form for modeling large systems and for control and servo 
design. It allows for 999 blocks per model. Graphic support is required. This can be 
an IBM Color Graphics Board with color or NTS monochrome CRT, a Hercules 
High Resolution Graphics Board, an IBM EGA board in the default CGB mode, an 
IBM Dot Matrix PC and Epson Printers, or any other printer that will work with the 
IBM "Graphics" DOS command. 

The TUTSIM® program is designed for the simulation of 
continuous dynamic systems. The key to use of the program is the preparation of 
the TUTSIM block diagrams. A problem is defined, mathematical models 
developed, a block model is composed based on the mathematical model, and the 
program presents results graphically. This is shown in Figure 6. Model parameters 
are easily entered and changed. Results are available in graphical display or 
numerical tables on the screen or as hard copy* 

The program originated at Twente University of Technology in the 
Netherlands. Development has continued over 14 years with users now found 
worldwide. The core of TUTSIM is written in assembly language allowing for the 
fastest possible program execution. Non-linears, discontinuous, and special math- 
ematical blocks add to its versatility. It is designed to be highly interactive allowing 
simulation interrupt with changes to parameters or output directives. TUTSIM can 
be called from other programs, modified, and re-run to optimize a parameter or for 
special analysis. The simulation algorithm allows the user to specify the delta time 
steps of the simulation. The entire model is "solved" at each delta time step. With 
well chosen time steps the solutions will closely approximate a continuous solution. 

Program limitations are largely those of the personal computers in 
terms of speed and memory. The mathematical algorithms must be realistic, how- 
ever, if the results are to be if any valve. During the control modeling algorithm 
preparation was by far the most exacting and tedious task. Once the model was 
developed the program ran well. 

Frequency domain analysis techniques are not included in this 
software. The two basic state equations of the model are derived from a summation 
of torques at the fuel and oxidizer turbopump assemblies. The angular acceleration 
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Block Mod«l: 



Results: 



Figure 6. Tutsim Program Application 






HI, C, Model Building (cont.) 

of the turbopump (TP A) shaft is obtained from the difference in turbine and pump 
torques divided by the inertia of the TP A. Additional states in the model relate to 
the average pressure between the pump discharge and turbine inlet for both the oxi- 
dizer and fuel circuits. These particular state equations account for the capacitance 
of the system. Phase lags between the combustion chamber temperature and turbine 
inlet temperatures were also incorporated to simulate the effect of thermal capaci- 
tance. A list of symbols is given in Table m. 

2. Engine Component Modeling 

The engine response during start-up and shut-down was obtained 
by combining the previously described turbopump dynamics model with a specified 
control configuration. Figure 7 illustrates the interrelationship between the two 
systems. The inputs are thrust and engine mixture ratio. These inputs are used to 
determine the required fuel and oxidizer flow rates. The turbine bypass valve 
schedule blocks represent table look-ups of the turbine bypass valve positions. 

Power balance runs at specified operating points through the throttling range were 
used to generate the bypass valve schedules (refer to Figure 8). 

D. START MODES/THROTTLING 
1. Tank Head Start 

Requirements for the OTV engine include a capability for successful 
starts at tank pressures equivalent to the vapor pressure of hydrogen at 37.8 *R and 
oxygen at 162.7* R. This is approximately 20 psia and 15 psia, respectively. On start 
the engine chamber is effectively at vacuum. The unaided maximum pressure dif- 
ferential available for start, then, is 15 psia which is set by the oxygen circuit. All 
line and component pressure drops must be accommodated within this pressure 
differential less a small combustion chamber pressure. This is a very small driving 
force for a rocket engine and poses a number of problems which are discussed below. 

a. Pressure Fluctuations From Propellant Boiling . The engines 
are very likely at a temperature of 200 to 300°R higher than the entering propellant. 
Lines, turbopumps, and valves must be chilled to the same temperature as the pro- 
pellant before pressure fluctuations from boiling propellants subside. During their 
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Table III 

Symbols Used in the Simulation and Control Models 


Symbols Used in Figure 11 and Table IV 


Qp 

N 

AP P 

r T 

J 

Xy 

c, A t 
Tj 
n P 

T p 

Co 

*t 

Pc 

Pt 


Pump Flow 

Pump Speed 

Pump Pressure 

Turbine Torque 

Turbo-pump Inertia 

Valve Position of Pump Pre-Valve 

Turbine Throat Equivalent Area 

Turbine Inlet Temperature 

Pump Efficiency 

Pump Torque 

Turbine Spouting Velocity 

Turbine Efficiency 

Turbine Gas Specific Heat Ratio 

Chamber Pressure 

Turbine Inlet Pressure 


Symbols Used in Figure 5 

P e - Turbine Exit Pressure 

H - Mean Turbine Blade Speed 

MR - Engine Mixture Ratio 

T c - Combustion Temperature 


Symbols Used In Figure 19 

U CO ne (*) " Commanded Actuator Positions 
U (t) - Actrual Acutator Positions 

U m (t) - Measured Actuator Positions (Inlcues Sensor Noise) 

Z (t) - System Control Variables (e.g., Chamber Pressure, Turbine Speed, etc.) 
Z m (t) - Measured Control Variables 
Z (t) - Estimated Control Variables 
F - System Matrix 
G - Control Matrix 
H - Output Matrix 
D - Control Output Matrix 
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Table III 

Symbols Used in the Simulation and Control Models (Cont) 


Symbols Used in Figure 7 

Mf - Mass Flowrate of Fuel 

M 0 - Mass Flowrate of Oxidizer 

SV - Sliding Valve Actuation (Proportional Valve) 

X v - Vavle Position 

(X v )p - Alogorithm for Vavle Positioning 
(M 0 )r - Algorithm for Turbine Bypass Vavle Positioning 

Based on Oxidizer Mass Flowrate 
(Mf)p - Alogorithm for Turbine Bypass Vavle Positioning 
Based on Fuel Mass Flowrate 

N - Feedback Signal from Oxidizer or Fuel Flow Used 

for Closed Loop Control of Turbopumps or MR 
D - Feedback Signal from Fuel Flow Used for Closed 

Loop Control of Mixture Ratio 
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IK, D, Start Modes/Throttling (cont.) 

chilldown period flowrates and pressures will be erratic within the flow circuits. A 
start at this time could be characterized by rapid chamber pressure fluctuations, 
uncontrollable mixture ratio changes, and intermittent loss of flame with subse- 
quent re-ignitions and pressure spikes. Such operation must be avoided. One 
means is to dump a specific amount of the propellants through the engine without 
ignition. This can cost several hundred pounds of propellant to achieve chilldown. 
Another option is to recirculate the chilldown propellants back to the tanks through 
recirculation loops. For such loops to work, however, there must be a recirculation 
pump in each circuit. The obvious choice is a small electrically driven pump 
located near the propellant tank outlet. It does not have to have a flow capacity of 
more than 10% of the full-thrust flowrate. With such a pump chilldown will be 
rapidly completed with little or no loss in propellant. A bonus is rapid tank 
pressurization from the returning propellant due to heat pickup from the engine 
and propellant conversion to the gas phase. 

The recirculation loop also requires added engine valves and 
lines to prevent the propellant from entering the injector during chilldown. The 
recirculation pumps can be continued in operation during the start to add a very 
useful boost in pressure to the engine. Once pumped idle is reached so that the 
autogenous pressurization system is operational they would be turned off. 

A compromise start /chilldown procedure would use some 
initial propellant dumping with ignition started just as soon as sensor data indicated 
stable pressures and temperatures at the turbopumps. 

b. Susceptibility to Combustion Transients . Combustion adds 
additional pressure fluctuations that, at low feed pressures, can be coupled to the 
feed system dynamics as a chug instability. This can be severe enough to damage 
equipment or couple with the vehicle dynamics to effect the whole vehicle as a pogo 
instability. The recourse is an immediate shutdown. Avoidance is best done by a 
rapid acceleration through the potential chug range to a stable engine operating 
point. We do not expect a prolonged period of operation at tank head idle for this 
engine; the available pressure drops are not high enough to preclude chug despite 
the expected smooth combustion with the proposed injector elements. 
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Ill, D, Start Modes/Throttling (cont.) 

c . Intermittent Combustion . The very low tank pressure requires 
a very low combustion chamber pressure for sustained operation. One concern is 
that the pressure spikes on lightoff may be high enough to stop propellant flow 
from one of the circuits. At that time the flame would extinguish only to be fol- 
lowed by another lightoff and pressure spike. This would be evident as a rapid 
popping that could be of increasing or decreasing magnitude. Continuous ignition 
during start would lessen the possibility of popping, but not entirely eliminate it. A 
better solution is to increase the system pressure to a value above the lightoff pres- 
sure spike. 

d. T ack at Repeatability From Start-to-Start. A highly repeatable 
start transient is very useful in mission planning. With a tank head start there will 
be some unavoidable variability between starts. This can be avoided by compressing 
the time between lightoff and reaching a stable operating point. Prolonged opera- 
tion at tank head idle would be characterized by large variations in delivered 
impulse for a given operating time. Such variations may be acceptable if they can be 

calculated in real-time. 

e. Control Element for Tank Head Start . A successful tank head 
start will require low pressure drop flow circuits. The engine schematic in Figure 4 
shows a fuel idle valve. This valve opens on start to bypass the hydrogen turbop- 
ump circuit for a low pressure drop propellant route to the injector. As combustion 
stabilizes and more propellant flows through the TP A circuit the idle valve can be 
closed. Mixture ratio is controlled by the modulation of the variable position fuel 

idle valve. 

f. Two Engine Thrust Vector Control. With side-by-side 
mounting of the two OTV engines the vehicle center of mass should be on a line 
between the two engines. Any difference in thrust between the two engines during 
start must be corrected by a gimbal movement of one or both engines or by firing of 
an attitude control thruster. Smoother operation will result if the start transient on 
both engines is very nearly identical and characterized by a rapid increase to a stable 

operating point. 
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Ill, D, Start Modes /Throttling (cont.) 

2. Pumped Idle Mode 


Pumped idle is defined as engine operation where the turbine 
power is sufficient to overcome the tare torque of the TPA. It represents minimum 
thrust operation with active turbomachinery. Up to that time the engine operating 
temperature and chamber pressure are relatively low since chamber pressure cannot 
exceed tank pressure minus system pressure drops. When the TP As begin to rotate 
the propellant pressure in the engine system is no longer limited by tank pressure. 
As an operating point, pumped idle would be somewhat above the start rotation 
condition so that system fluctuations would not stall the pumps. 

a. Control in Pumped Idle . At pumped idle the fuel idle valve is 
closed, and all propellant flows through the TPA circuits. The pressure operated 
back-pressure valves are functioning as high pressure drop flow restrictors (they 
never completely shut off flow and open completely when chamber pressure 
reaches 500 psia ±50 P psia). The hydrogen regenerator bypass and HGX bypass 
valves will be at 90% bypass (a margin of 10% is required for control authority) to 
control bulk temperature rise and chamber maximum wall temperature. The 
turbine bypass valves will be very nearly in the maximum bypass position but 
modulating for thrust and mixture ratio control. 

The stability of this mode is highly dependent on control range 
(i.e., valve position range and flowmeter accuracy) and the tare torque differences 
between the two mechanically separate turbopumps. The two pumps must begin 
rotation at very nearly the same time; otherwise, there is a risk that the rapidly 
increasing output from the rotating pump will cause a mixture ratio change beyond 
the control of the bypass valves. This mode is very difficult to model accurately 
without actual pump tare torque and performance data. 

3. Engine Throttling . 

The 10:1 throttling requirement is considered as a capability for fully 
controlled engine operation from 750 lbf thrust to 7500 lbs thrust at some mixture 
ratio between 5.0 and 7.0. There is no stated requirement for a specific rate-change in 
thrust although this is an important consideration in the controls design and there 
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Ill, D, Start Modes/Throttling (cont.) 

will be a practical rate limit. Relatively slow changes assure close control of mixture 
ratio. 


a. Throttling Applications . There are three likely mission 
scenarios where throttling is needed or useful: 

1) Landing a vehicle on the moon or Mars. 

2) A gradual reduction in thrust during propellant depletion 
to control G-loads on payloads sensitive to acceleration forces. 

3) Operation at lower than rated thrust to accomplish a pre- 
cise orbit adjustment maneuver or rendezvous. 

The first application will be the most demanding. If the engine control system can 
respond adequately to the moon lander mission needs, the other missions will be 
within the design envt' jpe. 

b. Throttling Control . Throttling is done primarily by 
commanding the oxygen turbine bypass valve to a specific position with the hydro- 
gen bypass valve adjusting as needed to keep within the mixture ratio range. 

During throttle down operation the hydrogen regenerator bypass valve will allow 
more bypass due to the hydrogen bulk temperature rise through the chamber. The 
oxygen regenerator bypass valve would also increase the bypass based on the 
reduced power requirement of the ox TPA. The principal valves used during 
throttling, however, are the turbine bypass valves. Their action has been modeled 
and is given in Figure 9. The non-linear oxygen bypass prediction at low chamber 
pressures is due to the actuation of the back pressure valve. This non-linear 
operating regime will require a different control algorithm for reliable operation. 
One possibility is the use of TPA speed to calculate oxygen flow at chamber pressures 
below 600 psia to compensate for nonlinearities in flowmeters and the oxygen tur- 
bine bypass valve. 
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Figure 9. OTV Engine Turbine Bypass Percent vs. Chamber Pressu 



IV. CONTROL LOGIC EVA LUATION 

A. SYSTEM GAINS AND SHAPING FILTERS 

For an uncompensated system there will always be an error between 
commanded thrust/mixture ratio and actual thrust/mixture ratio. This is due to 
such factors as general system disturbances and limitations in mathemattca 
modeling used for valve scheduling calculations. To overcome this difficulty a 
feedback compensation configuration is utilized. The shaping filters and feedback 
gains are designed to provide adequate system stability and response times with no 
steady state error. For the model depicted in Figure 7 the shaping filters were 
assumed to be of the proportional plus integral type and the feedback filters were se 
as unity gains. The dynamic simulation results shown in Figures 10 and were 
derived using the closed-loop model. From these results it can be seen that the sys- 
tem remains stable for changes in the command input signal. The simulation 
results, however, do not provide any information as to the overall stability of the 

system. 

B. CONTROL SYSTEM STABILITY ANALYSIS 

In order to determine the phase and gain margins, the system must first 
be linearized about an operating point. Once this has been accomplished, the over- 
all linear transfer function between input and output is used to calculate die stat 1 1 y 
margins. In performing the linearization for this application, the fuel and oxidizer 
circuits were treated independently. Figure 12 shows the linearized propellant cir- 
cuit equations. The partial derivative terms used in linearizing the torque expres- 
sions are given in Table IV. Analysis was started for determining system stabthty at 
the nominal thrust level. Additional work is still required to tune the system sue 
that results from both the linear and nonlinear models match. Further analysis will 
be required to verify system stability through the entire throttling range. This can 
only be accomplished by identifying a number of discrete operating points spanning 
the dynamic range. For each operating point the pardal derivative terms given in 
Table IV are evaluated. These values are then substituted into the linearized system 
transfer function. Model reduction techniques are used to simplify the trans er 
function so that frequency analysis methods may be utilized to determine the phase 

and gain margins. 
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Figure 10. Predicted Response to 10% Throttle Down Command 


30 



Figure 11. Predicted Response to 10% Throttle Up Command 
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Refer to Table III for Definition of Symbols 


Figure 12. OTV Engine Linear Dynamic Model 
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Table IV 

Parameters in the Engine Linear Dynamic Model 
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Table IV 

Parameters in the Engine Linear Dynamic Model (Cont) 
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Refer to Table III for Definition of Symbols 
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IV, Control Logic Evaluation (cont.) 

C. SYSTEM PERFORMANCE 

A basis of comparison is necessary in analyzing and designing control 
systems. Typical test signal inputs are step functions, ramp functions and accelera- 
tion or parabolic functions. By using a standard input which is representative of an 
actual input, a measure of system transient response can be made. For the OTV sys- 
tem the transient response of a unit step for thrust could be used to obtain the 
response time, percent overshoot and steady-state error. If the results of the analysis 
are unacceptable, for example the response time is too slow, the shaping filters and 
gains would be adjusted until satisfactory results are obtained. The response times 
of the preliminary model, at nominal thrust conditions (refer to Figures 10 and 11) 
are shown to be satisfactory. Simulations at many operating points need to be per- 
formed in order to verify the transient response over the throttling range. It is pos- 
sible that a variable gain schedule may be required to achieve both adequate stability 
and response over this range. 

D. CONTROL MODEL UPDATES 

Future model updates that will add to the dynamic model fidelity 
include: 1) modeling of hydrogen regenerator , 2) a more accurate model of the 
combustion chamber heat transfer process, 3) additional line and cooling jacket 
capacitance equations, 4) the use of actual valve area characteristic curves as a func- 
tion of stroke and valve actuator models and, (5) modeling of the LOX/GH2 heat 
exchanger. It should be noted that the linearization process described previously 
only applies to single input - single output systems. In actuality the OTV system is a 
multiple input - multiple output system; i.e., thrust and mixture ratio; however, 
since the desired mixture ratio was assumed to be constant, the analysis is pertinent. 
A state-space representation is commonly employed for multi-variable feedback sys- 
tems. This treatment provides analytic tools for determining the observability and 
controllability of the state variables, accounts for cross coupling effects, and can be 
used for determining optimum variable feedback gains over the range of operation. 
Software such as MATRIX-X, which is an integrated modeling, simulation, and 
control system package is available for this analysis. The control design module of 
MATRIX-X includes all linear system analysis functions including interactive 
classical and modern control design, conversion between model forms, and compu- 
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IV, D, Control Model Updates (cont.) 


tation of time and frequency responses. Non-linear models can be created and 
simulated interactively. There are six different integration algorithms available for 
simulating continuous, hybrid (mixed continuous/discrete), and even multi-rate 
digital systems. A system identification module is also provided which enables the 
user to transform test data into accurate system models. It is available to facilitate 
modern controls analysis. One standard feature allows the user to transfer from the 
Laplace domain, used in classical controls, to the state-space representation of mod- 
ern controls. The computing ability of this software will be very useful for future 
work if optimization or multiple feedback variable modeling become important 
design considerations. 

E. CONTROL CONFIGURATION 

The control configuration shown in Figure 7 is an approximation of the 
plant dynamics and feedback compensation for the system. A more detailed control 
logic is presented in Figure 13. In this concept the two basic feedback parameters are 
chamber pressure and oxidizer flow rate. The thrust and mixture ratio commands 
are rate-limited to avoid the possibility of severe system oscillations and thermal 
spikes or TP A stall. The commanded chamber pressure is calculated based on thrust 
and mixture ratio and fed forward to the feedback summing junctions and fuel and 
oxidizer turbine bypass valve schedules. Error signals between commanded cham- 
ber pressure and actual chamber pressure are fed through proportional plus integral 
controllers. These filtered signals are then summed with the table look-up stroke 
commands. At this point the total valve stroke signal actuates the valve to provide 
the desired compensation. The valve schedules are a multiple set of curves that 
give valve stroke as a function of engine chamber pressure and mixture ratio. Their 
basic function is to provide reasonable initial valve stroke positions so that con- 
troller modulation is kept to a minimum. Mixture ratio is controlled in the same 
manner as chamber pressure, with the difference that only the hydrogen turbine by- 
pass valve is modulated for a steady position of the oxygen turbine bypass valve. 

The time base start and shutdown valve schedules for the fuel circuit are shown in 
Figures 14 and 15. Note that all the valves, with the exception of the turbine bypass 
valves, the regenerator bypass valves, the LOX/GH2 heat exchanger valve and the 

fuel idle valve, are on-off valves. The on-off valve schedules are predetermined 
using dynamic simulation runs in order to achieve desirable start and shutdown 
characteristics. Included in the control logic is compensation for turbine inlet tern 
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Figure 14. OTV Engine Start-up Sequence 
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Figure 15. OTV Engine Shut-down 
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IV, E, Control Configuration (cont.) 

perature variations by use of regenerator bypass valves. The back pressure valves 
impose a high pressure drop during low chamber pressure engine operation so that 
the liquid oxygen converts to a high pressure gas under conditions well above the 
two phase dome. This is necessary to prevent two-phase flow into the injector. 
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V. CONTROL ELEMENT REQUIREMENTS 


There are four basic control elements: 1) the various flow control valves, 

2) those sensors specifically identified for engine controller use, 3) the controller 
hardware, and 4) the control software/ firmware. In addition, supplementary 
information can be gained from health management sensor data if suitably pro- 
cessed. For a piloted version of the OTV, commands from the pilot’s station can 
direct controller operation. An unmanned OTV would have vehicle guidance 
computer and telemetry inputs that would direct controller (and engine) operation. 

A. CONTROL VALVE REQUIREMENTS 

The basic control valve configuration is illustrated in Figure 4b. Of the 
12 valves depicted, five are modulation valves and seven are on-off valves. Table V 
is a list of of the individual valve functions. The valve operating environments are 
based on engine operating range extremes. Single page specifications for each valve 
are given in Appendix B. 

B. CONTROL SENSOR REQUIREMENTS 

Table VI gives a listing of the specified engine sensors, their purpose, 
operating ranges and types. Appendix B includes a complete listing of sensors with 
a summary of the ranges and operating characteristics. The sensors given in Table 
VI are necessary elements of the control system and serve as a logical starting point 
for developing sensor requirements for health management applications. 

C. ENGINE CONTROLLER REQUIREMENTS 

ATC has baselined the use of a controller developed under an IR&D 
program. This engine controller may be readily adapted to handle all of the OTV 
engine control requirements. Important features of the IR&D controller are. the 
use of hybrid microelectronics which are inherently small, light and rugged, dual 
channel redundancy architecture to eliminate single point failures; low power 
requirements; small size and low weight. The controller requirements of the OTV 
engine, which were compiled on the basis of the selected control logic, sensors and 
valves, is given in Table VII. The corresponding IR&D interface data are found in 
Table VIII. By comparing the information given in Tables VII and VIII, it is appar- 
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TABLE 
OTV ENGINE COW 

VALVE NAME 

ABBREVIATION 

FUNCTION 

Oxygen Main Shutoff 

OMSV 

Propellant Isolation 

Hydrogen Main Shutoff 

HMSV 

Propellant Isolation 


Oxygen Turbine Bypass 

OTBV 

Mixture Ratio Control 

Hydrogen Turbine Bypass 

HTBV 

Thrust Control 

ro 

Hydrogen Regenerator 
Bypass Valve 

HRBV 

Fuel Circuit 
Temperature Control 

Heat Exchanger Bypass 
Valve 

HEBV 

Oxygen Circuit 
Temperature Control 

Hydrogen Idle Valve** 

HIV 

Idle Operation 
MR Control 

Oxygen Back Pressure 

OBPV 

Heat Exchanger 
Pressure Control 

Hydrogen Back Pressure 

HBPV 

Pressure Balance 
During Start 


I 


I 


I 


l 


V 


VALVES 


FLUID 

OPERATING 

ENVIRONMENT 

TYPE 

Liquid O 2 

0 to 45 psia 
-310 to -298 °F 

PO were Open/ 
Solenoid Latch/ 
Spring Loaded 
Closed 

Liquid H 2 

0 to 45 psia 
0 to 40°R 

Powered Open/ 

Solenoid 

Latch/ 

Spring Loaded 
Closed 

Hot GOX 

0 to 5000 psia 
0 to 500 °F 

Servo/Pi ntle 
Fails in Place 

Hot GH 2 

0 to 6000 psia 
0 to 1000° F 

Servo/Pintle 
Fails in Place 

Cold GH 2 

0 to 5600 psia 
-340 to -420°F 

Modulating 

Poppet 

Fails in Place 

Hot GH 2 

0 to 2700 psia 
0 to 800 °F 

Modulating 

Poppet, 

Fails in Place 

gh 2 

80 psid, 0 to 6000 
psia -360 to 540°F 

Modulating 
poppet, fails 
closed** 

Warm G0 2 

200 psid, 0 to 5000 
psia -250 to 400°F 

Open/Partial* 

Closure 

Warm GH 2 

200 psid, 0 to 6000 
psia -360 to 600 “F 

Open/Partial* 

Closure 


I I I I 



1 1 1 

I 1 

i i i i 

1 1 



TABLE V (cont.) 
OTV ENGINE CONTROL 

i 

'valves 

VALVE NAME 

ABBREVIATION 

FUNCTION 

OPERATING 

FLUID 

Igniter Flow Control (2) 

*** OICV, 
HICV 

Igniter Propellant 
Flow Control 

GH2» GO 2 

Oxygen Tank 
Pressurization 

OTPV 

Oxygen Tank 

Pressurization 

Control 

Warm GO 2 

Hydrogen Tank 
Pressurization 

HTPV 

Hydrogen Tank 

Pressurization 

Control 

Warm GH 2 


* Pressure operated. No electrical actuation devices. These 
valves are used to raise circuit pressure high enough to 
avoid the two-phase dome for the oxygen heating and the 
consequent film boiling in the heat exchanger. 

** A pressure operated valve is an option. 

£ * ** *** Not shown on engine schematic. 


I I I I I 


ENVIRONMENT 

TYPE 

0 to 6000 psia 

Powered/Open 

-400 to 100° F 

Spring Loaded 


Closed 

0 to 3000 psia 

Powered Open/ 

0 to 400 °F 

Spring Loaded 


Closed 

0 to 5000 psia 

Powered Open/ 

0 to 800 °F 

Spring Loaded 


Closed 


As of April 1988. 



Table VI 

Engine Sensors for Baseline Control Logic 
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Table VII 

Selected Control Logic, Sensors and Valves Drive the Controller Requirements 


Vehicle to Controller Interfaces: 
Avionics Power Bus 
Utility Power Bus 
Serial Command Channels 
Power-up Command Channels 
Discrete Status Channels 

1 

1* 

1* 

1 

1* 

Controller-to-Engine Electrical Interface: 


On/Off Valves 

7 

Throttling Valves (Analog Commands) 

3 

Pressure Sensors 

3 

Temperature Sensors 

4 

Speed** Sensors or Vortex Shedding Flowmeters 2 

Valve Position (Analog Inputs) 

3 

1 

Regulated Avionics 

Ground Support Equipment Interface: 


Serial I/O 

1 

1 

Discrete Inputs 

Analog Outputs (Test Points) 

4 


‘Optional 

**At Low Speeds both TPA Speed and Flowmeter Readings 
must be used to Assure Adequate Mixture Ratio Control. 


Note: Quantities Listed are Per Channel 
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TABLE Vm 


IR&D ENGINE CONTROLLER - ENGINE INTERFACES 


Function Quantity 


Solenoid Valves /Devices 12 

Pressure Sensors 8 

Temperature Sensors - TC 2 

Temperatures Sensors - RTD 2 

Turbine Speed Sensors 2 

Valve Position Sensors 1 

Analog Commands 2 

Discrete Commands 8 

Analog Inputs 12 

Vortex Shedding Flowmeters (2 in series) 4 


(Quantities Listed On a Per Channel Basis) 


ORIGINAL PAGE IS 
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TABLE VIII (cont.) 


IR&D ENGINE CONTROLLER - VEHICLE INTERFACES 
Function Quantity 


28 VDC Avionics Power 1 

28 VDC Utility Power 1 

Power-Up Command 1 

Discrete Command Channels 3 

Serial Command Channels 1 

Serial Data Channels 1 


(Quantities Listed On A Per Channel Basis) 


V, C, Engine Controller Requirements (cont.) 

ent that the IR&D controller could be used on the OTV engine with minimal modi- 
fications. 


The IR&D controller has a 128K word memory capacity; approximately 
34K of this memory is required for engine control. Because the ER&D controller has 
a generous amount of surplus memory space, its application to the OTV program 
should not impose any limitations to control capabilities. 

Additional considerations dictated by multi-engine control remain to be 
examined. For example, start transient coordination, engine-out coordination com- 
pensation and gimballing are issues that will effect the final engine controller 
requirements for a multi-engine system. 



VI. HEALTH MANAGEMENT 


A. HEALTH MANAGEMENT SYSTEM DESCRIPTION 

The rationale for a health management system is to eliminate the high 
cost of losing a mission because of engine failure, and to reduce the high cost of 
returning space based engines to earth for servicing. It is a collection of methods for 
improving engine system reliability, performance and cost effectiveness through 
early fault detection and preventive maintenance. Functions provided by the 
health management system include: pre-flight engine check-out, detection of out-of- 
limit conditions, fail-operational /fail-safe fault tolerance for all flight critical func- 
tions, recognition of sudden shifts in performance, trend data collection and storage, 
off-line extrapolation of performance trends to plan scheduled maintenance, and 
modular fault isolation to permit more cost effective maintenance. The health 
management system functions continuously during engine operation and during 
pre- and post-checkout. At pre-flight testing it will evaluate the health of the engine 
sensors. After the flight it will process collected data and signal commands for 
required maintenance. The health management system will sequentially collect 
signals from sensors, process the signal data for efficient use, diagnose the engine 
component behaviors and evaluate actual engine system performance against 
commanded performance during the flight mode. Figure 16 illustrates the health 
management system flow paths. 

B. ENGINE FAILURE MODES 

A compilation of internal and component OTV engine failure modes is 
presented in Table IX. The health management system is responsible for detecting 
anomalies during engine operation caused by any of these failure modes either by 
direct sensor measurement or computational algorithms. The hierarchical structure 
of the health management system is shown in Figure 17. The red-line sensors are of 
primary importance for engine prognosis. If the red-line limits are exceeded during 
engine operation, shut-down commands are issued to the controller processor in 
order to avoid a catastrophic failure. Many of the red-line parameters are not mea- 
surable quantities; however, state estimation algorithms can be used to ascertain the 
unknown values from the measured data. The pink-line sensors are at a lower 
level in the health management architecture. The information provided by thesg 
sensors is compared with the established pink-line limits. Engine operation 
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Software Level 


Task 


Interface 


Hardware Level 


Controller 


Prognosis 


Diagnostic 


Report & Record 


Operation Commands 
Engine Control Restructure 
Mission Profile Evaluation 
Maintenance Scheduling 
Multi-Engine Interaction 


Model Restructure 
State Estimation 
Parameter Identification 
Parameter Trend Analysis 
Component Evaluation 
Failure Mode Detection 


Data Acquisition 
Signal Processing 
Faulty Signal Detection 
Data Reconstruction 
Signal Preconditioning 
Sensor Recovery Evaluation 


Operator Display 

Telemetry Data Selection- 
Health History Recording . 
Health Prognosis Display 


On Line 
Real Time 

◄ 



On Line 
Real Time 


4 =^- 

Z Real Time ^ 
Real Time ^ 
Selective Dejay 
Real Time ^ 
Readout on 
Command 


Engine System 
Controller 

Operator Inputs 

Engine(s) 

Component 


Sensor/Actuator, 

Controller 


Vehicle 


Arrows Indicate the direction of data flow or commands. For instance, vehicle operator (pilots or a 
control center remotely located but In radio contact with the vehicle) can make inputs through an 
interface to the engine controller. The HM system also channels information to the operator display 
as either real time data, selective data, analyzed data with a time delay, or data commanded by the 
operator. 


Figure 16. Health Management System Configuration 
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TABLE IX 


Component 

TPA 


TCA 


Line 

Valves 


Engine Sensor 

Igniter 

Controller 


OTV ENGINE FAILURE MODES 

Failure Modes 

Pressure Loss in Hydrostatic Bearing 
Turbine Blade Chipping or Cracking 
Oxygen Turbine Fire due to Rubbing 
Nozzle Erosion Crack 
Corrosion or Fatigue Failure 
Pump Cavitation Damage 
Seal Rupture 
Blanching 

Cooling Channel Contamination 
Injector Contamination 
Chamber Fatigue Cracking 
Connection Leak 
Overheating/ Undercoolng 
Connection Leak 
Line Cracks 

Open Circuit (Electrical) 

Sensor Malfunction (No Position 
Indictation) 

Electrical Short 

Malfunction (Change in Bias, Failure) 

Interface Break-Down 

Igniter Valve Failure 

Spark Plug Failure 

Open Circuit/Short 

Module Break-Down 

Interface Break-Down 

Cooling System Failure 

Algorithm Defect 
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EACH LAYER OPTIMIZED FOR ITS OWN FUNCTION 
CONTROL ISOLATED FROM HEALTH MANAGMENT FAILURE 
MODULAR STRUCTURE AIDS DEVELOPMENT 



DECREASING IMPORTANCE TO OPERATION- 
INCREASING RELIABILITY REQUIREMENTS 


Figure 17. Layered HM/C System Architecture 




VI, B, Engine Failure Modes (cont.) 

modification commands are sent to the control processor if any of the pink-line 
limits are exceeded. Prompt preventive measures during engine operation are 
needed to avoid more serious consequences. The generalized detection algorithm 
flow diagram is depicted in Figure 18. 

Component or engine failures can be due to external causes as well as 
faults within the engine system. The space environment includes high radiation 
levels that can destroy electronic parts and weaken structural materials. A compre- 
hensive health management system should include radiation dose recorders with 
an alerting system when critical levels are approached. Also there is an ever present 
hazard from micrometeorites and space debris that could be responsible for a variety 
of failures. The health management and control system must be able to effect a 
timely engine shutdown after such an encounter. The aerobraking maneuver also 
poses some hazards. Failure of an engine cover door would place the engine system 
in a high temperature, highly fluctuating aerodynamic load environment. The 
likely failure would be in the extendible exit cone, but high temperatures could 
destroy control elements. The health monitor system would have to assess damage 
prior to any engine start attempt. The multiple possibilities for electrical failure 
require mechanical backup such as valves that are spring loaded closed on power 
failure. These are the most obvious externally caused failures, but there are others. 
The health management system should be designed to safely handle all of them. 

C. DESIGNING FOR SYSTEM RELIABILITY 

Any complex data system must be designed to accommodate normal 
operating fluctuations and measurement error. Since noise and general system dis- 
turbances are random processes, statistical methods are used to filter all measured 
data. The reliability of the digital electronic control system can be improved by 
incorporating control component redundancy at the sensors, the actuators, or the 
controls computer itself. 

The two types of sensor redundancy techniques use hardware and/or 
analytical programs. Analytical redundancy uses a reference model of the engine to 
provide redundant estimates of a measured engine variable using a data base from 
high reliability sensors. Hardware redundancy uses multiple sensors to measure the 
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VI, C, Designing for System Reliability (cont.) 

same variable. Voting strategies can then be used to detect and isolate sensor fail- 
ures so that a faulty sensor can be eliminated from the system without initiating a 
false command. A disadvantage of hardware redundancy is that it is insensitive to 
the type of failure, hard or soft, since any discrepancy between two redundant sen- 
sors always signals a failure. Hard failures are classified as failures that are out-of- 
range or large-in-range failures, soft failures are small in-range or small bias shifts. 
Other drawbacks to hardware redundancy are reflected in added component com- 
plexity, cost, and weight. Analytical redundancy is able to distinguish hard and soft 
sensor failures. Range or rate checks are used to provide successful detection of hard 
sensor failures and statistical decision theory and optimal filtering are used to detect 
soft failures. A functional block diagram of a sensor fault algorithm is shown in 
Figure 19. A sample of a detection algorithm is given in Figure 20. State estimate 
techniques are commonly used for analytic redundancy; however, limitations are 
imposed by the necessity of an accurate linear model and the assumption that the 
disturbances on the system are well modeled or else have an insignificant effect on 
plant or parameter variations. A new approach that eliminates the need for state- 
space computations uses the estimation error space of each observer in a bank of 
observers to detect and isolate sensor failures. 

A very important benefit of a multiple engine system configuration is 
the improvement in the redundancy capabilities of the health management system. 
For example, sensor measurement data from one engine can be used as redundant 
information for sensor failure detection on another engine. Since proper control 
response requires comparison of key operating variables from each engine, the 
interconnection of systems is already necessary, and the benefit to health manage- 
ment is obtained at little extra cost. 

In an earlier task a Failure Modes and Effects Analysis (FMEA) was com- 
pleted for the OTV engine. This analysis was updated and is included as Appendix 
C as it is still relevant to the baseline engine design. The analysis covers the critical 
components. Other failures are possible. The list of failure modes in Table IX was 
generated using the FMEA. 
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Process Noise Sensor Noise 



Figure 19. Testbed System with Advanced Diagnosis Algorithm (ADIA) 



Figure 20. Normal Mode Accomodation Filter Logic 
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VI, Health Management (cont.) 


D. MODULAR HEALTH MANAGEMENT SYSTEM DESIGN 

The health management algorithms have been classified under three 
levels of implementation: engine, component and sensor. The general structure is 
outlined in Table X according to the task performed, algorithm used and available 
software to perform the task. The functional descriptions of these algorithms at the 
engine sensor levels is detailed in Tables XI and XD, respectively. Some of the 
health management task objectives may be limited by the sensor and computational 

capabilities of the system. 

The component failure detection algorithms compare actual to expected 
component performance. Expected performance is derived from analytical compo- 
nent models, developmental hardware testing, and prior component experience. 
System measurements are used to determine actual performance. A disparity 
between actual versus predicted performance signals the health management sys- 
tem to take appropriate corrective actions. An example of fault detec- 
tion/verification logic for a gas generator-driven TP A is shown in Figure 21. 

A block diagram of the basic flow paths of the health management mod- 
ule is shown in Figure 22. The system is subdivided into a set of real-time and off- 
time functions. Real-time functions which occur during engine operation include: 
sensor measurement validation, sensor and component failure detection, isolation 
and accommodation, data acquisition and alarm signaling. Off-time functions are 
performed during pre- and -post-flight regimes for assessment of engine readiness 
and maintenance needs. 

E. HEALTH MANAGEMENT DATA STORAGE 

A number of possibilities exist for data storage of health management 
data. Available memory technologies and their associated attributes are summa- 
rized in Table XIII. 

The health management data recorder requirements differ somewhat 
from those for the engine controller. More memory storage is necessary; however, 
the processing requirements for health management data recording are less than 
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Table X 

Health Management Algorithm 


Software Software 


Level 

Task 

Algorithm 

Type 

Code 

Sensor 

Data Acquisition 

Protocol 


Assembly 


Signal Conditioning 

F 1 1 ter 

Band Pass 
Filter 

Jovial/Ada 


(Preconditioning) 

Compensation 

(Simple) 

Jovial /Ada 


Failure Detection 

Redundancy Manage- 
ment 


Jovial/Ada 

(Component) 


Level Checking 

(Simple) 

Jovial/Ada 

(Component) 


Signature Analysis 

Time Series, 
FFT 

Jovial/Ada 


(Data Construction) 

Kalman Filter 

Kalman Filter 

Jovial/Ada 


Sensor Evaluation 

Diagnostic Testing/Calibrating/ 
Requalifying 

Lisp/ 

Expert 

Component 

Model Construction 

Status Diagnostic 


Lisp/ 

Expert 


State Estimation 

Kalman Filter 

Kalman 

Filter 

Jovial/Ada 


Parameter Ident. 

Recursive Least 
Squares 

Optimization 

Jovial/Ada 


Trend Analysis 

Regression 

Modeling 

Time Series 

Jovial/Ada 


System Ident. 

Verify Component 

FFT 

Jovial/Ada 


Failure Detection 

Failure Diagnostic 


Lisp/ 

Expert 



Condition Prog- 
nostic 


Lisp/ 

Expert 

Engine 

Report/Document 

Data Base 
Management 


Lisp/ 

Expert 


Engine Reconfig. 

Failure Mode 
Management 


Lisp/ 

Expert 


Mission Evaluation 

Mission Profile 
Analysis 


Jovial/Ada 


Maintenance 

Schedule 

Logistic Manage- 
ment 


Lisp/ 

Expert 


Engine Command 

Command Schedule 


Jovial/Ada 
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Table XI 

Health Management Software at Engine Level 


Task 

Model Construction 
State Estimation 
Parameter Identification 
Parameter Trend Analysis 
Component Evaluation 


Failure Mode Detection 

Report/Document 

Engine Reconfig. 

Mission Evaluation 
Maintenance Scheduling 

Engine Command 

Signal Routing 


Algorithm 

Status Diagnostic 
Kalman Filtering 
Recursive Least Squares 
Regression Modeling 
System Identification 
Level Checking 
Signature Analysis 

Failure Diagnostic 
Condition Prognostic 
Data Base Management 

Failure Mode Management 

Mission Profile Analysis 
Logistic Management 

Command Schedule 

Protocol 


Function Description 

Failure Mode Compensation 

Estimate State 

Identify System Parameter 

Predict Engine Condition 

Verify Comp. Character 

Level, Rate Threshold 

Pattern Recognition of 
Component 

Identify Failure Mode 
Identify Health Condition 

Manage Health Monitoring 
Data 

Reconstruct Engine 
Geometry 

Evaluate Mission Profile 

Post Flight Maintenance 
Schedule 

Engine Reconfig. 
Compensation 

Supply User Functions: 

1) Controller 

2) Vehicle Operator 

3) Telemetry 

4) Health Monitor 
Recorder 
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Table XII 

Health Management Software at Sensor Level 


Task 

Algorithm 

Function Description 

Data Acquisition 

Protocol 

Multiplexing 

Sensor Status 
Registration 

Sampling Rate 

Data Storage 

Signal Conditioning 

Filter 

Noise Separation 


Compensation 

Gain Tuning 

Failure Detection 

Redundancy Management 

Voting, Averaging, 
Mid-Value 


Level Checking 

Level, Rate Threshold 


Signature Analysis 

Pattern Recognition, Self 
Inspection 


Kalman Filtering 

State Estimation 

Data Construction 

Kalman Filtering 

Estimate State 

Signal Preconditioning 

Filter 

Disturbance Isolation 

Recovery Evaluation 

Diagnostic Testing 

Testing Sensor 


Calibration 

Calibrating Sensor 


Requalification 

Requalifying Sensor 

Signal Routing 

Protocol 

Supply User Functions: 

1) Controller 

2) Vehicle Operator 

3) Telemetry 

4) Health Monitor 
Recorder 
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Figure 22. Condition Monitoring Block Diagram 
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TABLE XIII 


AVAILABLE DATA STORAGE TECHNOLOGIES 


1. SOLID STATE MEMORY 

Fastest approach possible 

Requires more volume for storage than other technologies 
Very rugged and easy to interface 

2. MAGNETIC MEMORY DEVICES 

Magnetic Tape Drives - Extensive use for aircraft and 
unmanned satellites 

Bubble Memory Devices - Rugged but low density and 
power hungry 

Ruggedized Hard Discs - High storage capacity and 
speed 

3. OPTICAL DISKS - DERIVED FORM CONVENTIONAL COMPACT DISK 
TECHNOLOGY 

Write once read only memory (WORM) 

Gaining acceptance for use in military aircraft 
Very high data capacity (1 /2 gigabyte per 5" disk) 

TRADES REQUIRED TO MAKE DECISION 
Total data traces to be recorded 
Sample rates of the data traces 
Susceptibility to radiation environment 
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VI, E, Health Management Data Storage (cont.) 

that for the real-time control computations of the controller. Single-string electron- 
ics are sufficient for non-flight critical functions and there are essentially no output 
electronics required for the data recorder. 

Selected data streams will be processed and used for pilot display. At a 
minimum there will be a real time presentation of the following information for 
each engine: 

1. Position in the start or shutdown sequence 

2. Engine thrust 

3. Engine mixture ratio 

4. Turbine inlet temperatures (O 2 and H 2 ) 

5. Gimbal position 

6. Engine compartment temperature 

7. Extendible exit cone position 

8. Fuel and Ox start valve position 

9. Turbine speed (O 2 and H 2 ) 

Operation of a piloted space vehicle will be closely monitored by the 
spaceport and earth-based stations. Engine condition will be part of the routine 
telemetry broadcast from the OTV. The telemetry will include normal operational 
data but will be expanded to add data on red line or emergency conditions encoun- 
tered during a mission. This is real-time data and may differ from the recorded data 
and pilot display information. 

F. APPLICATIONS FOR ARTIFICIAL INTELLIGENCE AND EXPERT SYSTEMS 

A comprehensive health management system will produce an enor- 
mous amount of data. At any given time most of it is redundant or irrelevant. Dis- 
crimination between pertinent and useless data requires informed judgement. Tra- 
ditionally this is where a human takes over from the machine, but any person or 
even a whole crew will be unable to handle the mass of data for real time decision 
making. Data selection will have to be a function of the computer with only limited 
crew-directed additions. The computer should be capable of bringing a potential 
problem to the crew's attention, suggesting solutions, evaluating pilot input com- 
mands, and presenting alternatives should the pilot input be predicted to worsen 
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VI, F, Applications for Artificial Intelligence and Expert Systems (cont) 

the problem. When time does not permit dialog with a human the computer must 
act to save the mission and/or the vehicle while informing the crew of the problem 
and the corrective action taken. These capabilities are at the current state-o - e-ar , 
and will have to be developed for future manned space travek The use o exper 
systems software will be needed for these demanding applications. 


G. HEALTH MANAGEMENT SENSORS 

The group of sensors required for basic engine control was described pre- 
viously and is shown in Table I. Additional sensors are used to supplement the 
control sensors for the purpose of health management. Specifically, they are use 
for failure detection, isolation and accommodation, performance monitoring, an 
data acquisition of non-critical flight parameters used for post-flight maintenance 
analysis. A combined list of control and health management sensors is presente in 
Table XIV. A more detailed listing is given in Appendix B. 

A review of advanced technology was made for bearing monitoring, 
pressure measurement, shaft monitoring, and hot spot detection. Bearings are cn ‘‘ 
cal life-limiting components in rocket engine turbopumps, thus bearing monitoring 
is an important facet of the health management system. The function of sha 
monitors is to measure axial and radial shaft deflection and shaft speed all of which 
may be used for TPA diagnostics. Preliminary requirements for a displacement sen- 

sor are given in Table XV. 

Currently silicon microchip displacement sensors are one of the more 
effective means of measuring rolling contact bearing outer race deflection. This 
measurement gives a direct indication of bearing health. Race deflection is sinu- 
soidal in nature due to the balls passing by the sensing element as they trave 
around the race, refer to Figure 23. The signatures created by the balk are analyze 
to determine bearing defects. By comparing the signatures of a good bearing wi a 
bearing containing a defective ball. Figure 24, it is evident that this method provi es 
a straightforward means of fault detection. 

The objectives of investigating advanced sensor technologies for shaft 
monitoring are: to provide significant size and/or weight reduction, reliable opera- 
tion at cryogenic temperatures, and improved packaging of signal conditioning 
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TABLE XIV 


CONTROL AND HEALTH MANAGEMENT SENSORS 


Component 

Pump 


Turbine 


Bearing 


Thrust Chamber 


Required Measurements 

Flow Rate 
Shaft Speed 
Inlet Pressure 
Discharge Pressure 

Shaft Speed 

Inlet Pressure and Temperature 
Outlet Pressure and Temperature 
Shaft Vibration 
Turbine Blade Temperature 
Turbine Blade Clearance 

Bearing Supply Pressure 
Bearing Temperatures 
Hydrostatic Channel Flow Rates 
Radial Shaft Motion Transducers 
Axial Shaft Motion Transducers 
Shaft Speed 

Coolant Jacket Inlet and 
Outlet Pressures 

Coolant Jacket Inlet and 
Outlet Temperatures 

Chamber Pressure 

External Coolant Jacket Wall 
Temperatures for Hot-Spot Detection 


Function 

Head, Flow, Speed 
Relationships and 
Cavitation Effects 


Turbine Performance 
Verification 

Turbine Blade Health 


Bearing Health, 
Efficiency 


Thrust Chamber 
Health and 
Performance 
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TABLE XIV (cont.) 


Component 
Control Valves 


Injector 

Igniter 
Regen Liner 


Rpquired Measurements 

Valve Upstream and Downstream 

Pressures 

Valve Position 

Acoustic Internal Leak Detectors 
"Sniffer-Type" External Leak 
Detectors 

Injector Inlet Pressure 
Chamber Pressure 
Injector Inlet Temperature 
Face Temperature 

Ignition Pulse Detector 
Cavity Temperature 
Temperature Distribution 


Function 

Valve Monitoring 


Health and Performance 

Operation Verification, 
Cooling 

Health and Trend (Life) 
Prediction 
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TABLE XV 


DISPLACEMENT SENSOR REQUIREMENTS 


Type 

Range 

Resolution 

Error Band 

Repeatability 

Thermal Sensitivity Shift 

Temperature Range 

Frequency Response 

Pressure Range 

Excitation 

Signal 

Size 

Material Compatibility 
Liquid & Gaseous 
Liquid & Gaseous 
Liquid & Gaseous 


TBD 

0.001 to 0.005 inch radial 
0.001 to 0.009 inch axial 
0.00001 inch 
± 1.0% of range 
± 0.25% of range 
± 0.005% of range/°C 
-253°C to +100°C 
50 KHZ 
0 to 10,000 psia 
10 volts DC 
0 to 5 volts DC 
TBD 

Oxygen 

Hydrogen 

Nitrogen 
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Deflection 0-10 A/Inch 
Output 0-50 V 


Control 


Vcc 


Signal 


Control 


Ground 


Ground 


Figure 23. Example of a 


Bearing Health Monitoring Silicon Sensor 
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H Signature of Good Bearing Signature of Bearing with One Defective Bail 

.001 Sec 

• Small AmpiHude Variation e Large Amplitude Variation 


• 60,999 RPM 


• 60,000 RPM 


NOTE: CRT Presentation Adjusted for Best Signal Clarity. In Both Cases Amplitude 
is Proportional to Maximum Depth of the Machined Step in the Running 
Surface. Shaft Cobble Changes the Position of the Trace on the “Y” Axis. 


Figure 24. Reproduction of Actual Oscilloscope Traces of Turbopump Bearing Signatures 
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VI, G, Helath Management Systems (cont.) 

logic The current approach involves the use of a multifunction sensor probe for 
axial and radial displacement and speed. Methods which seem most likely to meet 
the accuracy and resolution requirements of the application are capacitive, optical 
(fiberoptic) and inductive. The capacitive transduction method appears to be the 
most stable under varying environmental conditions as capacitance is a function of 
the physical dimensions and dielectric constant of the media. A further advantage 
is that the capacitive sensor tip is the most adaptable to multiple function sensing. 

A conceptual design based on a three function sensor using capacitive transduction 
has been prepared and is in development. Figure 25 is the sensor envelope which is 
designed to fit the oxidizer turbopump. Figure 26 shows the active sensor tip con- 
figuration. The sensor tip has three sets of sensing electrodes, one set for radial dis- 
placement and two sets for axial displacement. One set of axial displacement elec- 
trodes is used for speed pickup when a step is machined into the running surface. 

The sensing tip is ceramic with metallized electrodes. Signal processing electronics 
are provided in a semiconductor chip at the sensor tip. Local signal processing is 
essential to minimize the effects of leakage capacitance. 

An electronic hot spot detector for measuring combustion chamber cool- 
ing channel temperature is shown in Figure 27. The detector is composed of 120 
equally spaced thermocouples (refer to Figure 28 for the sensor configuration). This 
sensor can be used for the direct detection of local or overall chamber overheating. 

H. SENSOR SUPPLIER SURVEYS 

ATC has conducted two surveys of health monitor suppliers. The first 
was a comprehensive survey completed in 1983. The survey data is presented in 
Figure 29. Approximately 40% of the companies contacted responded. Most of these 
had product lines closely related to commercial operations and applications. ATC 
did select 19 suppliers as producing or capable of producing sensors of use in the 

OTV engine. 

The second survey was conducted in February 1987 to assess the available 
technology for sensing high speed turbopump shaft motion. An initial literature 
search yielded 122 items related to displacement sensor application. Detailed litera- 
ture was ordered and evaluated. In addition, the profiles of 151 companies listed in 
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Figure 26. Multifunction Turbopump Shaft Monitor Active Tip Configuration 
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Figure 27. Hot Spot Sensor Assembly 
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Figure 28. Hot Spot Sensor Configuration 



CONTACT BASIS: 


Developer/Supplier of Transducers for: 

• Acceleration (Angular and Linear) 

• Flow (Gas and Liquid) 

• Force 

• Leakage 

• Position (Angular and Linear) 

• Temperature 

• Velocity 

• Other (Torque, Heat Flux, Sound, Stress) 
NUMBER OF CONTACTED: 

e 242 

RESPONSES (As of 26 October 1983): 
e 100 

ADDITIONAL FOLLOW-UP 

• 19 Suppliers 


Figure 29. OTV Engine Health Monitoring - Sensor Supplier Survey 



VI, H, Sensor Supplier Surveys (cont.) 


the Spnsor and Transducer Directory were reviewed. They were all listed as having 
displacement or proximity sensors in their product line. Inquiries were sent to 50 of 
these companies asking for information on the following types of sensors: 

Displacement, linear 
Displacement, mechanical 
Displacement, optical 
Displacement, ultrasonic 
Proximity, magnetic 
Proximity, ferrous 
Proximity, non-ferrous 
Proximity, ultrasonic 
Proximity, capacitive 

On examination of the literature received from the responding companies, the 
methods judged most likely to meet the OTV engine turbopump sensor require- 
ments are capacitive, optical (fiberoptics), and inductive, the requirements for a dis- 
placement sensor are given in Table XV. 

The results of the supplier survey are included as Appendix A. 

I. REVIEW OF VEHICLE PRIME STUDIES 

The vehicle primes have produced many volumes documenting vari- 
ous concepts and analytical results as a prelude to actual OTV development. Very 
little of this mass of information is directly applicable to problems of engine control 
and health monitoring. What is relevant to the propulsion designer are 1) the type 
of missions in the mission model, 2) total vehicle propellant loads, 3) the type of 
aerobraking proposed, 4) maintenance concept and timelines (to include delivery, 
assembly, checkout, disassembly, and preparation for return to earth), and 5) life 
cycle cost implications. To some extent these mission requirements have been dis- 
tilled and quantified as the propulsion requirements presented in Table n. The 
most notable omission is a listing of which engine components should be replace- 
able in space, and any type of criteria for engine time change. The ATC 3.0K thrust 
engine was designed for replacement at the engine level with no on-the-vehicle 
engine maintenance. Thus any anomalous health monitor system diagnosis would 
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VI, I, Review of Vehicle Prime Studies (cont.) 

trigger an engine change. This is a very desirable situation for decision making but 
could be costly if engine changeout required significantly more time than a compo- 
nent changeout. 

The present ATC approach recognizes the vehicle Prime contractor's 
quantification of the high cost of in-space maintenance and the desirability of com- 
ponent versus engine changeout. The 7.5K thrust engine will be designed for some 
component changeout. These components are listed in Table XVI. This is a fairly 
long list and may be incomplete at this stage in the engine design. The O 2 and H 2 

turbopumps will be designed for changeout in space although it may be more eco- 
nomical to perform the changeout with the engine removed to a specialized main- 
tenance facility at the spaceport. The concern is to preserve the integrity of the lines 
to and from the pumps. When work will be done with little clearance and with all 
the restrictions of space suit operation it could prove cheaper to replace an engine 
than struggle with a difficult component changeout. Timelines must be developed 
for each maintenance operation to aid in the decision. 

The General Dynamics vehicle study did address delivery, assembly, and 
OTV servicing operations. Table XVII is a listing of the major operations from 
arrival at the Space Station to payload integration or storage of the OTV. Those 
operations where the engine health monitor system will be used are indicated by an 
asterisk. The typical operational scenario for an OTV mission is divided into time 
sequenced functions as indicated in Table XVIII. The engine health monitor system 
is used in those functions indicated, as before, by an asterisk. A more detailed out- 
line of the space based maintenance functions is given in Table XIX. The health 
monitor system will be used for both troubleshooting and verification that the 
maintenance has corrected the problem. 

Of the five items listed above as relevant to the propulsion designer, the 
most demanding is that of man-rating. The health monitor and control system 
must assure safe piloted operation of the OTV in so far as this is a function of the 
propulsion system. If this is built into the design most of the other requirements 
will be satisfied by straightforward engineering solutions. Low life cycle cost is pri- 
marily a function of engine life and overall reliability. ATC is designing for low 
stress levels on all parts, for wide strength margins in all high temperature 
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TABLE XVI 

OTV ENGINE SPACE MAINTAINABLE COMPONENTS 
75 LBF THRUST ENGINE 


component 

hydrogen main shutoff valve 

OXYGEN MAIN SHUTOFF VALVE 
HYDROGEN BOOST PUMP (LOW PRESS) 

OXYGEN BOOST PUMP (LOW PRESS) 

HYDROGEN AUTOGENOUS PRESSURIZATION VALVE 

OXYGEN AUTOGENOUS PRESSURIZATION VALVE 

HYDROGEN REGENERATOR BYPASS VALVE 

OXYGEN REGENERATOR BYPASS VALVE 

GIMBAL MOTORS 

GIMBAL ACTUATORS 

EXTENDIBLE NOZZLE 

EXTENDIBLE NOZZLE DEPLOYMENT MOTORS 
EXTENDIBLE NOZZLE DEP. MECHANISM 
FUEL FLOWMETERS 
OXYGEN FLOWMETERS 
CONTROLLER 

SENSOR SIGNAL CONDITIONING UNITS 

miscellaneous hardware, brackets, wires, 
external sensor elements 


COMMENT 

REQUIRES access near engine /vehicle interface 
requires access near engine/vehicle interface 
requires access near engine/vehicle interface 
requires access near engine/vehicle interface 
requires access near engine/vehicle interface 
requires access near engine/vehicle interface 

DESIGN DEPENDENT; MAY BE A BOLT-ON TO A MANIFOLD 
DESIGN DEPENDENT; MAY BE A BOLT-ON TO A MANIFOLD 

requires access near engine/vehicle interface 
requires access near engine/vehicle interface 

READY ACCESS 

requires access near engine/vehicle interface 
requires access near engine/vehicle interface 
DESIGN DEPENDENT; MAY BE BOLT-ON TO LOW PRESS BOOST PUM 
DESIGN DEPENDENT; MAY BE BOLT-ON TO LOW PRESS BOOST PUMP 
ONE OR TWO REMOVABLE BOXES WITH CANNON PLUGS 

dependent on access 



TABLE XVII 


INITIAL OTV DELIVERY AND ASSEMBLY OPERATIONAL FUNCTIONS 
Dock Shuttle to Station 

• Offload and position core section 

• Offload aerobrake, struts, aerobrake door, and RCS thrusters 

• Deploy aerobrake 

• Attach RCS thrusters, aerobrake, and aerobrake door 

• Inspect OTV assembly 

Checkout OTV System 

• Bring all systems online* 

• Perform OTV system operational testing* 

• When fault or damage detected* 

Perform damage assessment 
Initiate fault isolation routine 
Perform OTV unscheduled maintenance 
Perform OTV system operational testing 

• Proceed with payload integration or deactivate and stow OTV 

*Operations where the OTV engine health monitor system is used 


TABLE XVIII 


OTV SERVICING OPERATIONAL FUNCTIONS 


BERTH OTV 

• RENDEZVOUS OTV WITH STATION 

• CAPTURE OTV AT STATION 

• BERTH OTV AT STATION 


TRANSFER PROPELLANT 

• VERIFY INTERFACE INTEGRITY 

• PERFORM PROPELLANT LEAK CHECK 

• TRANSFER RESIDUAL PROPELLANT FROM OTV STATION 


INSPECT OTV 

• PERFORM VISUAL INSPECTION 

• DETERMINE OTV FAULT STATUS* 

• WHEN FAULT OR DAMAGE DETECTED* 

PERFORM DAMAGE ASSESSMENT (TV /EVA) 

INITIATE ELECTRICAL TEST ROUTINE TO VERIFY FAULT 
INITIATE FAULT ISOLATION ROUTINE 

• FORMULATE INTEGRATED MAINTENANCE PLAN* 

PERFORM OTV M AINTENANCE 

. PERFORM SCHEDULED/UNSCHEDULED MAINTENANCE TASKS* 

• MISSION RECONFIGURE 

• PERFORM SYSTEM OPERATIONAL TESTING* x/TCCTrw AT ^ttc 

• DEACTIVATE & STOW OTV (IF NOT REQUIRED FOR MISSION AT THI 

TIME) 


MATE OTV & PAYLOAD 

• TRANSFER PAYLOAD TO OTV 

• MATE PAYLOAD TO OTV 

• VERIFY OTV/PAYLOAD INTERFACE 

• PERFORM OTV/PAYLOAD INTEGRATION TEST 


T AT INCH OTV/PAYLOAD 
. PERFORM PRELAUNCH OPERATIONS* 

• TRANSFER PROPELLANT FROM STATION TO OTV 

• LAUNCH OTV/PAYLOAD* 


♦OPERATIONS WHERE THE OTV ENGINE HEALTH MONITOR SYSTEM IS 
USED 
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TABLE XIX 


SPACE-BASED OTV MAINTENANCE FUNCTIONS 


Perform scheduled maintenance 

• Transfer propellant to and from OTV 

• Perform visual inspection 

• Determine OTV fault status 

• Replace ACS modules (after each mission) 

• Replace engine module* (after TBD mission time) 

• Perform system operational testing 

• Service fuel cell (after TBD mission time) 


Perform 




unscheduled maintenance 

Perform damage assessment (beyond scheduled inspection) 
Verify electrical failure 
Isolate fault to replaceable unit 
Perform damage repair 

Perform required remove and replace due to failure 


*The vehicle can be developed with replaceable propulsion modules or for 
individual engine replacement. In-space handling requirements may dictate one or 
the other design solution. Table XX lists the steps in removing an engine in 
Aerojet's design concept. 
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TABLE XX 


OTV ENGINE REMOVAL OPERATIONS 


• Engine Centered, Nozzle Extended 

• Propellant Isolation Valves Closed 

• Electrical Power Removed from the Engine 

• Manual Operations: 

Electrical Harness Disconnected, Cannon Plugs Capped, Harness Stowed 
Extendible Nozzle Removed, Screw Assemblies Secured, Regen Cooled 
Nozzle Edge Protector Installed 

Main Hydrogen Line Disconnected Below Shutoff Valve, Capped 
Main Oxygen Line Disconnected Below Shutoff Valve, Capped 
Hydrogen Tank Autogenous Pressurization Line Disconnected Below 
Shutoff Valve, Capped 

Oxygen Tank Autogenous Pressurization Line Disconnected 

Below Shutoff Valve, Capped 

Engine Handling Fixture Connected 

Engine Out Gimbal Actuator Disconnected 

Control Gimbal Acuators Disconnected 

Hex Lines Restrained, Upper Engine Covered with Protective Material 
Prime Mover Connected to Engine Handling Fixutre 

• Engine Moved out of Engine Compartment 
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VI, I, Review of Vehicle Prime Studies (cont.) 

materials, and the generally conservative design selections that accompany high 
reliability. The basic control system will be proven on an operational rocket engine 
15 years before it is flown on the OTV engine. The health monitor sensors will all 
have a pedigree that includes a wide range of missions and test conditions. This 
design approach should give the lowest life cycle cost and the safest operation for a 

piloted space vehicle. 
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VII. DISCUSSION OF RESULTS 


A. ENGINE CONTROL AND MODELING 

A variety of control simulations of the dual expander engine design 
were successfully run, but project changes and resource constraints precluded 
performing simulations over the entire operating envelope. Such simulations 
would need to be run if work continues in developing the dual expander cycle 
engine. Also, the component models used in the simulations can and should be 
updated as component development proceeds. 

The results of the control simulations using the TUTSIM program were 
acceptable even though more cases would have been desirable. In both throttle-up 
and throttle-down scenarios the proposed control valve arrangement performed 
within acceptable limits of mixture ratio and thrust excursion. There was no set- 
point hunting, and transitions were free from spikes or short term oscillations. The 
concept of mechanically separate turbopumps for this engine is practical from a con- 
trols standpoint from the pumped idle point to some overthrust point above the 
nominal 7500 lbf of thrust. What could not be proven in the controls simulation is 
the practicality and controllability of a tank head start. With the very low pressure 
available (15 psia) for a tank head start actual components, as built versus as 
designed, can seriously effect operating margins. No one can guarantee a successful 
tank head start for an engine of this complexity until actual components are built 
and tested; even then, start-to-start repeatability will be questionable and subject to 
lack of success from even small changes in system fluid properties or temperatures 
of components. 

Engine shutdown is a much more straightforward operation. The main 
propellant valves are simply closed and residual propellants allowed to burn to a 
pressure where combustion is no longer sustained. The relatively large line and 
component volumes will produce a tailoff impulse lasting 2 or 3 seconds. Both 
startup and shutdown are slow compared to storable propellant rocket engines 
where these transient conditions are measured in milliseconds. 
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VII, A, Engine Cntrol and Modeling (cont.. 

There is a maximum time-rate-of-change for throttle commands that 
must be compatible with mission requirements. If the most demanding mission is a 
landing on the moon or Mars then this is calculable once the vehicle weight and 
number of engines are determined. This should be done early enough in the engine 
development to establish it as a controls requirement. Otherwise it could become a 
mission limitation or an expensive problem needing solution. This controls analy- 
sis did not attempt to assess the maximum throttle rate with the baseline control 

system. 

The software package used for this simulation, called "TUTSIM, is in 
widespread use but has several limitations. A major one is incompatibility with 
frequency domain analysis techniques. It is also primarily adapted for personal 
computers and the limitations in processing speed and memory of PCs. A main- 
frame software package such as MATRIX-X includes all linear system analysis func- 
tions including interactive classical and modem control design, conversion between 
model forms, and computation of time and frequency responses. It should be con- 
sidered for any future extension of this controls modeling work. It was just recently 
added to ATC's library of programs; too late to be used in this task. 

B. CONTROL ELEMENTS 

The basic control elements are valves, flowmeters, pressure and temper- 
ature sensors, turbopump speed sensors, and an electronic controller. In the inte- 
grated approach sensor data from an additional array of sensors supplements the 
control sensor data to allow a health management software/ firmware system to 
evaluate engine health and, if necessary, direct a specific controller action. It can 
also synthesize data for the controller should some control sensor(s) be inoperative. 
The desired result is a more flexible control system with greatly improved safety and 
reliability. Work done in this task tends to confirm this as an achievable goal in so 
far as the mechanical control elements are concerned. Valves can be developed and 
sensors obtained without any major technology challenges to the OTV engine 
development. Development work is needed on turbine bypass valves. Sensors 
need to be miniaturized while reliability is improved. Those are achievable with 
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VII, B, Control Elements (cont.) 


logical extensions of present technology; no breakthroughs are needed. This is not 
necessarily true of the software/firmware that takes the sensor data and processes it 
to predict engine health and diagnose engine problems. This will be a significant 
development task and one that may require artificial intelligence software for best 
applicability to the task. It is worthy of separate consideration as a development 
task. The work done here on sensors and system architecture can serve as a good 
starting point. 

C. HEALTH MONITORING 

Health management comprises three separate tasks: real time monitoring 
of engine health; and recording of information for a permanent maintenance record 
with guidance on component changeout, recalibration, and troubleshooting, and an 
intelligent selection and processing of data streams. Health management must be 
done with the speed needed to prevent imminent failure from becoming catas- 
trophic. It is evident that computational requirements are high and programming 
an extensive process. The basic engine controller can be readily developed from 
well advanced work on a bipropellant engine controller at ATC. The interacting 
health management system is not well defined in terms of hardware. It should be 
an electronic box much like the controller, mounted adjacent to it, have direct con- 
nection to the Health Monitor sensors, and have a remotely located recording unit 
accessible to both vehicle crew and maintenance. The form taken to record its pro- 
grams is uncertain as is the memory storage. It will be a very sophisticated com- 
puter, and should be a candidate for early development work. 
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VIII. SUMMARY OF RESULTS 


This report documents the first extensive work done in defining an inte- 
grated health management and control system for the Orbit Transfer Vehicle (OTV). 
The work was divided among four subtasks: 1) engine system modeling, 2) control 
logic evaluation, 3) control element requirements, and 4) health monitoring. The 
task work led to the following conclusions: 

1. Engine System Modeling 

a) There is a maximum time-rate-of-change for throttling 
operation, but additional work needs to be done to define it. 

b) Changes in the details of the engine schematic need to be 
modeled and incorporated into the system model to assure controllability and 
stability are maintained as the design evolves. 

c) Additional work needs to be done to tune the systems so 
that the linear and nonlinear models match. 

d) The most poorly defined engine operation is tank head 
start. The low pressure budget makes actual equipment variables critical in defining 
whether it is possible. Actual tests will be needed to prove its feasibility. 

2. Control Logic Evaluation 

a) The baseline engine control system can control thrust and 
mixture ratio from pumped idle mode to some thrust above nominal. 

b) Mechanically separate hydrogen and oxygen turbopumps 
can be used for normal fixed thrust operation and throttling operations. 

c) The control logic evaluation showed that turbine bypass 
valves could control thrust and mixture ratio as planned over most of the thrust 
range using flowmeter data. At low thrust conditions, flowmeter data may have to 
be supplemented with turbine speed readings to assure that mixture ratio does not 
exceed allowable limits if only one pump should rotate. 
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VIII, Summary of Results (cont.) 

d) Closed loop control configuration is required for the OTV 
engine. There is no capability for a start without a functioning controller. 

e) Control system stability was achieved at all the operating 
points checked, but additional work needs to be done to assure that the system was 
stable over the entire operating range. In particular, the range where the oxygen 
turbine bypass control effects are non-linear needs to be assessed. 

0 A preliminary failure-mode and effects analysis (FMEA) 
was completed for the baseline controls configuration. 

g) A reliability assessment was completed in terms of design 
impact. This report recommends analytical redundancy wherever possible instead 
of hardware redundancy. 

h) Control of this engine is considered verified on a 
preliminary basis,but additional work should be done concurrent with a test bed 
program. 

i) An integrated approach to health management and 
control is considered practical with this report serving as a starting point for follow- 
on work. 


3. Control Element Requirements 

a) The basic control elements of valves, flowmeters, and 
sensors have been identified and well enough specified to begin procurement or 
detail design actions. 

b) An ATC developed controller was evaluated for the 
controller requirement and was found to be acceptable with some modifications. 
This could be a significant savings in an engine development program. 

c) A sensor supplier survey was completed and the results 
presented. All expected sensor needs can be met with development programs well 
within the engine development time span.] 


.£ 
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Vm, Summary of Results (cont.) 

4. Health Monitoring 

a) The health management system was defined in sufficient 
detail that sensors were identified, a system architecture was developed, and a data 
recording system proposed. This is sufficient definition to be used as the baseline for 
a detailed design or to assist in defining requirements for a health management 
system software development program. 

b) Prime contractor vehicle studies were reviewed and 
health management related activities identified. The system will be used for pre- 
flight/ post-flight, and permanent maintenance record purposes based on Prime 
identified operations. 

c) A component in space maintenance list was developed 
but no timelines were available for evaluating the practicality of component 
changeout. The alternative of complete engine removal was presented and a list of 
steps in the changeout included. The basic maintenance philosophy needs to be 
defined after considering the timelines and extra-vehicular activity (EVA) costs. 
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APPENDIX A 

SENSOR SUPPLIER SURVEY RESULTS 
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SURVEY OF AVAILABLE SENSOR TECHNOLOGY 


In order to identify and evaluate approaches to measure axial and radial shaft 
displacements of high speed turbomachinery, a survey of available technology was 
undertaken. The objective of this survey was to determine the current state-of-the- 
art for displacement sensors, their capabilities and applicability to the OTV 
turbomachinery. 

A library literature search was made yielding 122 items. The literature cov- 
ered a wide range of transducer subjects including inductive, capacitive, ultrasonic, 
optical, and fiberoptic devices. Those that appeared pertinent were obtained and 
reviewed. 

Profiles from 151 companies listed in the "Sensor and Transducer Director" 
which listed displacement or proximity sensors in their product line were reviewed. 
Inquiries were sent to 42 companies from this list which appeared to have applicable 
technology. Most of the responses described devices and technology that were for 
industrial applications and did not have the accuracy and resolution needed. 
Examples of some of the commercially available displacement measuring 
instruments which most nearly meet our requirements are shown on Table A-l. 
Included in this investigation are the following displacement measuring technolo- 
gies: 


1) Inductive 

2) Capacitive 

3) Optical 

4) Ultrasonic 

The following assessments were made of the available technologies based on 
past experience combined with the results of this investigation: 

Inductive 


Inductive displacement sensors measure the distance from the sensor to the 
target by generating a high frequency magnetic field. As the target moves toward the 
sensor coil eddy currents are generated in the target material which show up as 
losses in the oscillator bridge network. The variations in losses or distance are 
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Table A-1 

Displacement Measurement Instruments 


Type 

Manufacturer 

Range 

Mil 

Resolution 

Mil 

Accuracy 

Si ze 
inches 

Temp. 
Range °F 

Output 

Freq . 
Response 

10kHz 

Comments 

Reauires signal condi- 
tioner (proximitor) 

Size 2. 0x2. 4x3.1 in. 
Laroer size probes avail. 

Inducti ve 

Bently Nevada Corp. 
Minden, Nevada 

70 


± i% 

0.2 dia 
0.8 Lg 

-30 - 
+350 

200 mv/mi 1 

Inductive 

Metrix Instriment Co. 
Houston, TX 

80 



0.19 dia 
1.26 Lg 

-35°C - 
+175°C 

200 mv/mi 1 

3kHz 

Requires signal condi- 
tionr. Used ImHz excition 
to probe. 

Inductive 

Kaman Inst. Co. 
Colorado Springs, CO 

10 

0.004 

± 1/2% 

0.08 dia 
0.81 Lg 
#10/32THD 

-65°F - 
+300°F 

100 mv/mi 1 

50kHz 

Reoulres sional condi- 
tioner. Several probe 
sizes available. Thermal 
sensitivity shift 
0.008 mn/°F 

Inductive 

Scientific-Atlanta, 
Inc., Atlanta, GA 

80 



0.19 dia 
0.75 Lg 

-30 - 
+350°F 

200 mv/mi 1 

50kHz 

Requires signal condi- 
tioner 

Capacitive 

ADE Corp. 
Newton, MA 

3 to 9 

1 x lO’ 3 

± 0.4% 

0.10 dia 
Tip 
0.280 
x 1.0 lg 
overall 


± 10 vdc 

Full 

Scale 

40kHz 

Probe contains 4 diodes 
and Is excited from 3kHz 
driver. External 
linearization circuits 
req’d. Min. electrode 
dia * 0.019 in. 

Capacitive 

MTI Inc. 
Latham, N.Y. 

0.25 to 
10 

10 x 10-3 

± 0.4% 

.25 x 
2.5 in. 

-200°F 
- +400° F 

± 10 vdc 

5kHz 

Special coax cable req'd. 
No electronics in probe. 
Higher resolution for 
smaller range. 

Fiberoptic 

(Lever) 

MTI 

Latham, N.Y. 

0.002 to 
0.0055 

1.4 x 10-3 

* 5% 

0.063 in. 
x 3.0 in. 

-100 - 
300° F 

6 

60kHz 

Probes available to .020* 
diam. with lesser 
performance 

Fiberoptic 

(Lever) 

EOTec Corp. 
West Haven, CT 

-.005 

.06 min/mv 


.285 dia 
x .95 in. 

ig 

0-10 volts 

5kHz 


Laser 

Triangulation 

Diffracto, Ltd. 
Troy, MI 

0.080 

4 x 10' 2 

*1.25% 

6 x 3.4 x 
1 in. 



200/sec 

2 inch standoff distance 
reoulred 



detected and used as a measurement of displacement. A typical block of the sensor 
system is shown in Figure A-l. 

Inductive sensors are widely used for displacement sensing in industrial 
applications and machinery. ATC has used them successfully in rocket engine tur- 
bomachinery for non-cryogenic applications. Sensors are available as small as 0.08 
in. dia x 0.8 in. long. Larger diameter sensors measure larger displacements. Output 
is typically 200 mv per 0.001 inch. Frequency response is as high as 50KFIz for some 
units. 


Some of the factors affecting the indicated displacement are: 

(a) Target material resistivity and permeability 

(b) Proximity of sensing tip to conducting material 

(c) Temperature of sensor 

(d) Temperature of target 

Multiple sensors in close proximity to each other can cause crosstalk and noise 
which will diminish their accuracy. 

Our recent experience in using inductive sensors at liquid nitrogen tempera- 
tures (-320°F) has indicated erratic behavior with large signal changes under con- 
stant displacement conditions. In another case where sensors were designed specifi- 
cally for use in liquid hydrogen the performance appears to be better. The initial 
calibration shows fairly good linearity from 0.005 to 0.0015 inches. Zero shift is from 
zero to 0.003 inches from temperatures of -320°F to -411°F. To be useful the 
operating temperature must be known continuously and calibration curves at the 
appropriate temperature must be available or a temperature compensating signal 
conditioning unit is needed. 

Factors affecting calibration are: 

(a) Coil resistance and temperature coefficient 

(b) Target material resistivity and temperature coefficient 

(c) lead resistance variations 
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Output Bridge Sensor 


Figure A-1. Displacement Sensor Schematic 
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Target 





Capacitive 


Capacitance displacement sensors use the capacitance between the sensor 
electrode and the target as a measure of distance. The circuit capacitance is inversely 
proportional to the distance between the sensor electrode and the target. Because 
the measured capacitance is very small (in the picofarad range) it is necessary to 
eliminate the effect of probe and lead leakage capacitance which can be many times 
the measured capacitance. Several signal conditioning approaches are used to try to 
meet this objective. Figure A-2 lists the characteristics of two commercially 
available capacitive instruments capable of precision measurements. The ADE 
instrument excites the capacitive sensor with a high frequency (3mHz) driver to 
provide a current proportional to the tip capacitance. The current is rectified by four 
diodes in the sensor tip to provide a D.C. output for displacement measurement. By 
placing diodes in the sensor tip leakage capacitance effects are minimized and the 
output signal is D.C. Frequency response of 50KHz is claimed with resolution better 
than one microinch for sensor target separation in the range of 0.010 inches. Stan- 
dard sensor probe diameters as small as 0.280 inches are available. No cryogenic 
temperature performance is claimed; however, with rectifying diodes as the only 
temperature sensitive elements in the probe tips performance could be expected to 
be as good as the available diodes for cryogenic service. 

The MTI instrument is an example of another capacitive displacement 
instrument. This instrument has no active electronics in the sensor tip and uses a 
guarded circuit to eliminate the effects of stray and cable capacitance. The sensor 
configuration is shown in Figure A-3. 

For a range of 0.01 inches its resolution is 10 microinches. Frequency 
response is 5kHz maximum. Standard sensor diameter is 0.25 in. for a 10 mil range. 

Optical 

Optical displacement sensors use light reflected from the target as a means of 
measuring displacement. To obtain high resolution and accuracy special provisions 
are required. Some laser-based systems use triangulation to obtain displacement. 
These systems are usually bulky and not suitable for aerospace applications. 
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Figure A-2. Block Diagram of Capacitive Sensor 
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Figure A-3. MTI Sensor Configuration 




One unique system which takes advantage of fiberoptic technology is repre- 
sented by an instrument manufactured by MTI. It measures light reflected from the 
target through a bundle of optical fibers. The arrangement is shown in Figure A-4. 
The sensor system utilizes adjacent pairs of light transmitting and light receiving 
fibers. The basis for the sensing mechanism is the interaction between the field of 
illumination of the transmitting fibers and the field of view of the receiving fibers. 
At contact with the target no light is provided to the receiving fibers. As the gap is 
increased a rapid increase of light to the receiving fibers is realized until an optical 
peak is reached. Beyond that gap the light reflected to the receiving fibers decreases 
according to a square function. 

This system provides resolution in the microinch range with sensors as small 
as 0.063 diameter. Sensors have been made as small as 0.020 diameter with some 
loss in resolution. Problems due to differential expansion of the fiberoptic bundle 
and the metal sheath have occurred at cryogenic temperatures. Variations in sur- 
face reflectance and media opacity will result in measurement errors. In addition, 
accurate measurements are difficult to achieve without on-line gap adjustments. 

Ultrasonic 


Ultrasonic displacement transducers measure distance by reflecting high fre- 
quency acoustic energy from the surface of the target and measuring the transit time. 
These systems have a resolution capability in the range of 0.001 in. which is inade- 
quate for measuring rotor dynamics of high speed turbomachinery. In addition, 
media temperature variations can introduce significant errors as sonic speed is a 
function of temperature. 


A- 8 







APPENDIX B 
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Preliminary Valve Specifications 


This integrated controls and health monitoring project was started while the 
baseline Aerojet version of the OTV engine was a 3000 lbf thrust dual expander cycle 
engine. The task was completed after a NASA directed change to the baseline 
engine thrust was made. The new 7500 lbf thrust engine retained the basic dual 
expander cycle but engine design activities produced a number of changes to the 
propellant routing and valves. The original 3K lbf thrust engine schematic is given 
in Figure B-l. The later version of the 7.5K lbf thrust engine is given in Figure B-2. 
All specifications for valves are keyed to the requirements of the 7.5K lbf thrust 
engine. The specification sheets also contain an envelope diagram giving general 
dimensions for use in layout drawings and initial valve procurement action. These 
specifications were developed in the engine preliminary design task, and details on 
criteria and selection will be available in the report for that task. Valve 
specifications sheets are given as Figure B-4 through B-l 6. 

Preliminary OTV Engine Sensor Requirements 

OTV engine sensor requirements were thoroughly reassessed during the 
engine preliminary design task. Figure B-3 is a schematic of the most recent config- 
uration for the 7500 lbf thrust baseline engine showing sensor locations. This 
compilation of the sensors proposed for each engine includes those for the nozzle 
extension and its deployment mechanism and engine compartment sensors not 
actually installed on the engine but vital to determining safe engine function. The 
only sensors specific for engine control are the flow meters although the engine 
controller makes use of a variety of other sensor data. The sensors are divided into 
two groups: HM-1 for primary functions, and HM-2 for health monitor assessment 
and backup to the HM-1 group. This list is the result of a pre-screening of candidate 
sensors, but there was no concerted effort to reduce sensor numbers to any specific 
figure. Characteristics of the sensors are given in Table B-l. This includes estimates 
on sensor weight and power requirements. The function of the sensor is given 
according to priority. When sensor output is used by the engine controller this is 
the primary function although the data may also be used for health monitoring 
purposes. 
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TAM P8ESSURANT 


4800 PSIA 

TANK PRCSSURANT 


2300 PSIA 


T - TURBINE 

1 - LH 2 SHUTOFF VALVES 

2 - LOX SHUTOFF VALVES 

3 - TURBINE BYPASS VALVE GH. 


4 - TURBINE BYPASS VALVE G0 ? 

5 - GH 2 PRESSURIZATION CHECK VALVE AND REGULATOR 

6 - GOX PRESSURIZATION CHECK VALVE ANO RETULATOR 

7 - GH 2 START BOTTLE CHECK VALVE 

8 - G0 ? START BOTTLE CHECK VALVE 

9 - GH 2 TURBINE START VALVE 

10 - G0 2 TURBINE START VALVE 

11 - LH 2 TANK VENT VALVE 

12 * 10 2 TANK VENT VALVE 
JGN - IGNITION SYSTEM 

13 - OXIDIZER BACKPRESSURE VALVE 

14 - FUEL FILM COOLING VALVE 


Figure B-1 Dual Propellant Expander Engine 
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T ■ TURtMC 
I - MDOCEft 


THROTTLING 
VALVE 
UQOIO Mj 

WARMED GASEOUS Hj 
HEATED GASEOUS Hj 
UOUD 
WARMED Oj 
HEATED GASEOUS Oj 
A* at 4 April 1 98ft 


Figure B-2 7500 lbs Thrust OTV Engine Dual Expander Cycle 


B-4 






CHlCtf-.AL 

OF. POOR QUALITY 


03 

I 

U1 


OX TA.JK 

PRESS. 

VALVE 


OX 

TURBINE 

BYPASS 

VALVE 


©©Cm 



V = VALVE 
BP s BOOST PUMP 
PV s PRESSURE OPERATED 
VALVE 
P s PUMP 
T r TURBINE 

CONTROL TEMP SENSOR 
CONTROL PRES. SENSOR 
(T)= CONTROL FLOW SENSOR 

ffl D1SPL SENS0R Figure B-3. OTV Engine Dual Expander Cycle 
{Z) = H-M displ. sensor Sensor Locations 

(?) s H-M SPEED SENSOR 


GASEOUS H2 
GASEOUS H 2 
LIQUID Cfe 
GASEOUS 0 2 


As of 13 Jan. 1988 
3.1.0.48 






VALVE FUNCTION : hydrogen main shut-o ff 

VALVE TYPE : n.c..on/qff.ball:Bfly:bla de 

ACTUATION METHOD : 28 vdc motor 

EST. POWER REQ. : i65 watts 

EST. WT. (+-20%) : 8.5 lbs 

RESPONSE TIME : 

FLUID MEDIA : m 2 

OP. PRESS.(psia): qto 45 

OP. TEMP. (F deg): -400 to -422 

l DENS.(#/ft**3)(H/L): 4^4/ 4.34 

FLOWRATE(#/s)(H/L): 2j>3jo.26 

PRESS. DROP(psi)(H/L) : <5 

LEAKAGE ,EXT(socs of GHe): 1 x 10 4 
MATERIALS OF CONSTRUCTION : aluminum alloy 

OR TITANIUM ALLOY 

COMMENT S: FAIL SAFE CLOSED ON LOSS OF POWER 

LINE SIZE : _ 2.50 O.D. 

LEAKAGE.INT (sees of GHe): iQ @90psia ~~ 

CYCLE LIFE(Min): 500 

Figure B-4 
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I 


I 


I 


I 


1 
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VALVE FUNCTION : 
VALVE TYPE : 
ACTUATION METHOD : 

EST. POWER REQ. : 
EST. WT. (+-20%) : 
RESPONSE TIME: 

FLUID MEDIA : 

OP. PRESS.(psia): 

OP. TEMP. (F deg): 
DENS.(#/fT3)(H/L): 
FLOWRATE(#/s)(H/L): 
PRESS. DROP(psi)(H/L) : 


OX MAIN SHUT-OFF 
N.C..ON/OFF.BALL:BFLY:BLA DE 
28 VDC MOTOR 




LEAKAGE ,EXT(sccs of GHe): ixio •« 

MATERIALS OF CONSTRUCTION : aluminum alloy 


COMMENTS : FAIL SAFE CLOSED ON LOSS OF POWER 


LINE SIZE : 2 . 2 s o.d. 

LEAKAGE, INT(sccs of GHe): io@9Qp»ia 
CYCLE LIFE(Min): 500 


Figure B-5 



SHUT-OFF VALVE 


ORIGINAL PAGE FS 
OF POOR QUALJTY 


CD 

l 

00 


VALVE FUNCTION : 
VALVE TYPE : 
ACTUATION METHOD : 


OX TURBINE BYPASS 
SERVO/PINTLE 

28 VDC MOTOR 


60 WATTS 


9.2 LBS 


100 ms 


WARM GO2 


4937 / 330 


EST. POWER REQ. : 

EST. WT. (+-20%): 

RESPONSE TIME: 

FLUID MEDIA : 

OP. PRESS.(psia)(H/L): 

OP. TEMP. (F deg)(H/L): 

DENS.(#/ft**3)(H/L): 

FLOWRATE(#/s)(H/L): 

PRESS. DROP(psi)(H/L) : 

LEAKAGE ,EXT(sccs of GHe) 

MATERIALS OF CONSTRUCTION : inconel 71 8 and 


is sjm. 


1LLLL1 1 


13.0/1.06 


2290 / 100 


1x10 


• 4 


OBMQNEL 400 COMME NT : VALVE FAILS IN PLACE 


LINE SIZE : .750 o.d. 

OPERATIONAL LIFE(Hrs): 20 



Figure B-6 
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VALVE FUNCTION : 
VALVE TYPE : 
ACTUATION METHOD : 


HYDROGEN TURBINE BYP ASS 

SERVO/PINTLE 

28 VDC MOTOR 


EST. POWER REQ. : so watts 

EST. WT. (+-20%) : 9.2 lbs 

RESPONSE TIME : looms 

FLUID MEDIA : hotgh2 

OP. PRESS. (psia)(H/L): 4889 / 298 

® OP. TEMP. (F deg)(H/L): 540/818 

* DENS.(#/fT3)(H/L): 083/0.40 

FLOWRATE(#/s)(H/L) : Q. 3 / 0.16 

PRESS. DROP(psi)(H/L) : 2210 / 48 

LEAKAGE EXT.(sccs of GHe): '* ™ 

MATERIALS OF CONSTRUCTION: stainless steel or 


INCONEL 71 8 COMMENT : VALVE FAILS IN PLACE 





INLET 



3.50 

MAX 


LINE SIZE : .750 o.o. 

OPERATIONAL LIFE(Hrs) 20 


Figure B-7 
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VALVE FUNCTION : ox tank pressurization 

VALVE TYPE : n.c..on/off,poppet 

ACTUATION METHOD : 28 vdc solenoid 

EST. POWER REQ. : 2s watts ~~~ 

EST. WT. (+-20%): 2.6OLBS 

RESPONSE TIME : 200 ms 

FLUID MEDIA : 002 

OP . PRESS.(psia): 

OP. TEMP. (F deo): 0 to 400 

DENS.(#/ft“3)(H/L): 9.77 / .84 

FLOWRATE(#/s)(H/L) : 1.66 /.i4i 

PRESS. DROP(psi)(H/L) : 2585/ 215 """" 

LEAKAGE , EXT(sccs of GHe): 1 xio 4 
MATERIALS OF CONSTRUCTION : inconel 71s no 

MONEL 400 


N.C..ON/OFF.POPPET 
28 VDC SOLENOID 

25 WATTS 

2.60 LBS 

200 ms 


OtQ 3000 
0 to 400 

*•77 / «4 

1.66/ .141 
2585/215 


LINE SIZE : 
CYCLE LIFE(Min): 


.375 O.D. 


Figure B-8 
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I 


I 


3.0 


INLET 

TANK PRESSURIZATION 
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25 WATTS 


2-60 LBS 


200 ms_ 


VALVE FUNCTION : 

VALVE TYPE : 

ACTUATION METHOD : 

EST. POWER REQ. : 

EST. WT. (+-20%) : 

RESPONSE TIME: 

FLUID MEDIA : 

OP. PRESS.(psia): 

OP. TEMP. (F deg): 
DENS.(#/ft**3)(H/L): 
FLOWRATE(#/s)(H/L): 

PRESS. DROP(psi)(H/L) : 

LEAKAGE f EXT(sccs of GHe): i x io ' 4 _ 


HYDROGEN TANK PRESSU RIZATION 

NC..ON/OFF.POPPET 
28 VOC SOLENOID 


6.0 


GH2 


0 to 5000 


0 to 800 


0.49 / 0.04 


.375 / .031 


2620 / 220 



MATERIALS OF CONSTRUCTION : stainless steel 

OR INCONEL 718 — 


LINE SIZE: 375 o.d. 

CYCLE LIFE(Min): tbo 


Figure B-9 
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VALVE FUNCTION : hydrogen 

VALVE TYPE : n.c.. open/i 

ACTUATION METHOD : 28 vdc sol 

EST. POWER REQ. : 24 watts 

EST. WT. (+-20%): i lb 

RESPONSE TIME : 20 ms 

FLUID MEDIA : GH2 

OP. PRESS.(psia): 0-6000 

OP. TEMP. (F deg): -400 to 100 

DENS.(#/fT3)(H/L): 71.2/71.2 

FLOWRATE(#/s)(H/L): .040 / .0035 

PRESS. DROP(psi)(H/L) : tbs / tbs 

LEAKAGE ,EXT(sccsof GHe): 1 x i(T 4 
MATERIALS OF CONSTRUCTION : s.s. 


HYDROGEN IGNITER CON TROL 
N.C., OPEN/CLOSEPOPPET 
28 VDC SOLENOID 
24 WATTS 


LINE SIZE : 
CYCLE LIFE(Min): 


OUTLET 



.250 O.P. 


IGNITER VALVES 


Figure B-10 
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VALVE FUNCTION : 
VALVE TYPE : 
ACTUATION METHOD : 
EST. POWER REQ. : 
EST. WT. (+-20%) : 
RESPONSE TIME: 

FLUID MEDIA : 

OP. PRESS.(psia): 

OP. TEMP. (F deg): 
DENS.(#/ft**3)(H/L): 
FLOWRATE(#/s)(H/L): 
PRESS. DROP(psi)(H/L) : 


OX IGNITER CONTROL 

N.C..OPEN/CLOSED.POPPET 
28 VDC SOLENOID 
24 WATTS 
1 LB 
20 ms 

GQ2 

0 -6000 
-400 to 100 
4.50/4.49 
.145/ .0125 
TBS /TBS 


LEAKAGE ,EXT(sccs of GHe): i xio' 4 
MATERIALS OF CONSTRUCTION :monel4oo or 


INCONEL 718 



IGNITER VALVE 


INLET 


LINE SIZE : .250 o.p. 

CYCLE LIFE(Min): soo 


Figure B-ll 
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VALVE FUNCTION : hydrogen idle 

VALVE TYPE : pressure balance, open/partial close 


ACTUATION METHOD*: 

EST. POWER REQ. : 

EST. WT. (+-20%) : 
RESPONSE TIME : 

FLUID MEDIA : 

OP. PRESS.(psia): 

OP. TEMP. (F deg): 
DENS.(#/ft**3)(H/L): 
FLOWRATE(#/s)(H/L): 
PRESS. DROP(psi)(H/L) : 
LEAKAGE ,EXT(socs of GHe): 


LINE PRESSURE 
N/A 

5.0 LBS 
250 ms 
GH2 

80 psld ACTUATE, 0 to 600 0 psia 

-360 to 540 
.04 

0.0 TO .26 

0 0 *° 80 

• 4 

STAINLESS STEEL 


MATERIALS OF CONSTRUCTION : 


5.0 



LINE SIZE: i.oo o.o. 

OPERATIONAL LIFE(Hrs): 20 


•THIS IS AN ALTERNATE VALVE SHOULD MIXTURE 
RATIO CONTROL ON STARTUP PROVE CRITICAL 
AND REQUIRE A MODULATING VALVE. 

Figure B-12 
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VALVE FUNCTION : hydrogen regen, bypa ss 

VALVE TYPE : modulating poppet 

ACTUATION METHOD : 2bvdc motor 

EST. POWER REQ. : so watts 

EST. WT. (+-20%) : 9.2 lbs 

RESPONSE TIME : looms 

FLUID MEDIA : H2 . 

OP. PRESS.(psia)(H/L) ssso / 390 

OP. TEMP. (F deg)(H/L) -340 / -420 

DENS.(#/fT3)(H/L): 4.50/4.49 

FLOWRATE(#/s)(H/L): 0.53/0.26 

PRESS. DROP(psi)(H/L) : 7 sjj , 

LEAKAGE ,EXT(socs of GHe) 1 xio' 4 
MATERIALS OF CONSTRUCTION : aluminum alloy 

OR TITANIUM ALLOY 


MODULATING POPPET 
28 VDC MOTOR 
60 WATTS 

9.2 LBS 


5580 / 390 
-340 / -420 


>3 / 0.26 


COMMENT : VALVE MUST FAIL OPEN 


LINE SIZE: 

OPERATIONAL LIFE(Hrs): 


1.00 O.D. 



MOOULATNG VALVE 


Figure B-13 
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HYDROGEN IDLE 


N/A 


S.0 LBS 


250 ms 


GH2 


VALVE FUNCTION : 

VALVE TYPE : 

ACTUATION METHOD*: 

EST. POWER REQ. : 

EST. WT. (+-20%) : 

RESPONSE TIME : 

FLUID MEDIA : 

OP. PRESS.(psia): 

OP. TEMP. (F deg): 

DENS.(#/ft**3)(H/L): 
FLOWRATE(#/s)(H/L): 

PRESS. DROP(psi)(H/L) : 

LEAKAGE ,EXT(sccs of GHe): i x io ‘ 4 
MATERIALS OF CONSTRUCTION: sta.mi 


PRESSURE BALANCE, OP EN/PARTIAL CLOSE 
LINE PRESSURE 


80 psid ACTUATE, 0 to 600 0 psia 

-360 to 540 
.04 

0.0 TO .26 


0.0 to 80 


LINE SIZE : 

OPERATIONAL LIFE(Hrs): 


1.00 O.D. 


20 



I 

3.0 

1 


Figure B-14 
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INLET 
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VALVE FUNCTION : ox backpressurf 

VALVF TYPF ' OPEN/PARTIAL 

VnLVC ITrt . closed .POPPET 

ACTUATION METHOD : line pressure 

EST. POWER REQ. : n/a 

EST. WT. (+-20%) : 5.0 lbs 

RESPONSE TIME : 250 ms @ soopsia 

FLUID MEDIA : 002 

OP. PRESS.(psia): 010493^^^^^^^ 

OP. TEMP. (F dea): -260 to 400 

DENS.(#/ft**3)(H/L): 15.S/1.14 

FLOWRATE(#/s)(H/L) : 16.24/1.45 

PRESS. DROP(psi)(H/L) : 22 0 / 2.4 

LEAKAGE ,EXT(sccs of GHe): 1 x io~ 4 
MATERIALS OF CONSTRUCTION .’ inconel 71a on 

MONEL 400 


LINE PRESSURE 
N/A 

5.0 LBS 

250 ms @ SOQpsla 


0 to 4937 
-260 to 400 
15.5/1.14 
16.24 /1.4S 
22,0/2.4 


LINE SIZE : 
CYCLE LIFE(Min): 


1.75 O.D. 


Figure B-16 
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Component 


Oxygen 

Turbopump 

As$y. 


Oxygen 

Turbopump 

Assy. 


Oxygen 
Boost Turbo- 
pump Assy. 


Table B-1. 

Health Monitor and Control Sensor List (Cont.) 


Function 


Combustion 

Chamber 


P8 Pump 
Dlsch. Pres. 

T7 Pump 
Dlsch. Temp. 

F4 Pump Flow 


P9 Pump 
Inlet Pres. 


P10 Turbine 
Inlet Pres. 

T8 Turbine 
Inlet Temp. 

T9 Turbine 
Dlsch. Temp. 

T10 Pump 
Inlet Temp. 

F5 Turbine 
Inlet Flow 

Z18 Bearing 
Outer Race 
Deflectometer 


Z19 Bearing 
Outer Race 
Deflectometer 

Z20 Boost 
Pump Accel. 


P11 Boost Pump 
Inlet Pres. 


Til Boost Pump 
Inlet Temp. 

F6 Boost 
Turbine Inlet 
Flow 

PI 2 Chamber 
Pressure 


Location 


In Line @ 
Pump Ditch. 

In Line @ 
Pump Ditch. 


On T.P. Housing 
Between Bearings 

In Line @ 
Pump Inlet 


In Line <$ 
Turbine Inlet 

In Line @ 
Turbine Inlet 

In Line @ 
Turbine Dlsch. 

In Line @ 
Pump Inlet 

In Line @ 
Turbine Inlet 

On Bearing 
Outer Race 
.005 In. Nominal 
Clearance 


On Boost Pump 
Hsg. Between 
Brgs. 

In Line @ 
Pump Inlet 
Thermal Isolation 
Req'd by Tube 
Conn. 

In Line @ 
Pump Inlet 

In Line @ 
Turbine Inlet 


Combustion 

Chamber 


Control 


XX 


wt. 

PWR. 

0.5 Ox. 

10 VDC 
15MA 

0.7 Oz. 

10 VDC 
15MA 

12 Oz. 

28 VDC 
20 M A 

0.07 Oz. 

15 VDC 

4MA 

0.5 Oz. 

10 VDC 
15MA 


10 VDC 
15MA 


26 VDC 

20MA 

26 VDC 
20MA lor 
2 Sensors 


15 VDC 

4MA 


10 VDC 
15MA 


.7 Oz. 

10 VDC 


15MA 

.12 Oz. 

28 VDC 


20MA 

0.5 Oz. 

10 VDC 


15MA 
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Table B-1. 


Component 


Injector 



Health Monitor and Control Sensor List (Cont.) 


] Function 

Location | Control | HM-1 | HM-2 


At Injector 
Fuel Inlet 


At Injector 
Oxidizer Inlet 


P13 Fuel Inlet 
Pressure 

T12 Fuel Inlet 
Temp. 

P14 Oxidizer 
Inlet 

Pressure 



Combustion 

Chamber 


T13 Oxidizer 
Inlet Temp. 

PI 5 Chamber 
Coolant Outlet 
Pres. 

T14 Chamber 
Coolant Outlet 
Temp. 

P16 Chamber 
Baffle Coolant 
Outlet Pres. 

T15 Chamber 
Baffle Coolant 
Outlet Temp. 

T16 Chamber 
Throat Surface 
Temp. 

PI 7 Fuel 
Coolant Inlet 
Pres. 

T17 Fuel 
Coolant Inlet 
Temp. 

P18 Ox. 
Coolant Inlet 
Pres. 

T18 Ox. 
Coolant Inlet 
Temp. 


At Chamber 
Coolant Outlet 


At Transition 
Between Chamber 
Baffle Coolant 


Multiple Sensor 
Band Around 
Chamber Throat 


At Nozzle 
Fuel Inlet 
Manifold 


At Nozzle 
Ox. Inlet 
Manifold 


P19 Ox. 
Coolant Outlet 
Pres. 

T19 Ox. 
Coolant Outlet 
Temp. 

T20 Fuel Regen 
Outlet Temp. 

\ 21 Ox. Regen 
Fuel Inlet Temp. 

P20 Fuel Regen 
Inlet Pres. 


At Nozzle 
Ox. Outlet 
Manllold 


@ Fuel Regen 
Sec. Outlet Port. 

Ox. Regen 
Inlet Port 

Fuel Regen 
Inlet Port 
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Table B-1. 

Health Monitor and Control Sensor List (Cont.) 






Function 





Component 

Sensor 

Location 

Control 

HM-1 

HM-2 

Wt. 

PWR. 

Fuel Turbine 
Bypass Valve 

Z21 Position 

On V 
Pintle Ei 

alve 

(tension 

XX 



3.2 Oz. 
lor 1 In. 
Stroke 

28 VDC 
20MA 

Ox. Turbine 
Bypass Valve 

222 Position 



XX 







Hex. Bypass 
Valve 

222 Position 



XX 







Fuel Idle 
Valve 

Z24 Position 



XX 







Fuel Regen, 
Bypass Valve 

Z25 Position 



XX 







Nozzle 

Position 

Z26 Posltlon-Ret. 
Z27 Posltlon-Ext. 

Limit Switches 
at Limits of 
Travel 

XX 



0.3 Oz. 

28 VDC 
IMA 

Engine 

Compartment 

T22, T23, T24, T25 
Temperature 

In Engine 
Compartment 

4 Places 


X 


0.02 Oz. 

10 VDC 
15MA 

Engine 

Compartment 

LI, L2, L3, L4 
H2 Leak 
Detection 

In Engine 
Compartment 

4 Places 


X 


T 

BD 

T! 

ID 

Engine 

Compartment 

L5, L6, L7, L8 
O2 teak 
Detection 

In Engine 
Compartment 
4 Places 


X 



1 


f 

Total 



16 + 16 

46 

31 




B-23 



















APPENDIX C 

OTV ENGINE FAILURE MODES AND EFFECTS ANALYSIS 


C-l 


OTV DUAL PROPELLANT EXPANDER CYCLE ENGINE 
FAILURE MODES AND EFFECTS ANALYSIS 


COMPONENT OR 

SUBSYSTEM FAILURE MODE SYSTEM EFFECT 


Propellant Inlet Shutoff 1. 1 unit fails to close. 

Valves (LO2/LH2) 

(Series redundant/one 2. Both units fail to close. 

valve on each side of 

interface) 

3. 1 or 2 unit(s) fail to open. 

4. 1 unit fails partially open 
or closed. 

5. Response time out of tolerance 

o 

< 

ro 


1 . No effect - series redundant. 


2. No effect - close tank isolation 
valve. 

3. No engine operation W/O EVA 
and manual operation of valve. 

4. Engine may operate at partial thrust but can 
still be throttled, started, shutdown. 

5. No effect on closing (series 
redundant). No effect on opening due to 
to (relatively) long start time operation 
(tank head idle mode). 


Oxidizer Turbopump 
Assembly 


1 . Loss of LO2 to hydrostatic bearings 
(contamination). 


2 . Cavitation or bubble/gas ingestion 

due to blocked or restricted inlet 
(contamination, or partial inlet 
valve failure, or failure in propel- 
lant acquisition system.) 


1 . Bearings have redundant lubrication passages 
- partial loss may result in bearing wear. 
Significant or total loss may cause ignition 

or melting and HM directed shutdown. 

(Pump surfaces can tolerate rubbing friction 
for TBD msec without catastrophic failure). 

2 . Reduced pump life, reduced thrust. HM 
directed shutdown due to pump overspeed. 
Restart is possible if overspeed did not reach 
design limit. 


Page 1 of 6 
SYSTEM FAILURE 
FULL PARTIAL 


X 


X 


X 


X X 


X 




X 


I 


■ t t ! I I 



I I I I I 


COMPONENT OR 
SUBSYSTEM 


Fuel Turbopump 
Assembly 


0 

1 

CO 


Oxidizer Boost Pump 
Concept A : 

Individual boost pumps 
for each OTV engine. 

Concept B: 

2 ea. boost pumps feeding 
engine cluster inlet manifold. 


till 


i i 


OTV DUAL PROPELLANT EXPANDER CYCLE ENGINE 
FAILURE MODES AND EFFECTS ANALYSIS 


FAILURE MODE 

3. Turbine blade cracks, failure, or 
damage. 

1 . Loss of LH2 to hydrostatic bearings 
(contamination). 


2. Cavitation or bubble /ingestion 
due to blocked or restricted inlet 
(contamination or partial inlet 
valve failure or failure in propel- 
lant acquisition system). 

3. Turbine blade cracks, failure, 
or damage. 

1 . Pump fails to operate. 


2 . Pump operates at reduced flow or 
pressure. 

3. 1 pump to operate or operates at 
- duced flow or pressure. 

4. Both pumps fail to operate. 


SYSTEM EFFECT 

HM directed shutdown or reduced thrust 
operation. 

Bearings have redundant lubrication 
passages-partial loss may result in bearing 
wear, reduced pump life. Total loss will 
result in pump failure. 

Reduced pump life, reduced thrust. 

HM directed shutdown due to pump over- 
speed. Restart is possible if overspeed did 
not reach design limit. 

HM directed shutdown or reduced thrust 
operations. 

Requires tank head start - questionable 
reliability 

Engine MR, thrust, Isp are effected. 

No effect - parallel redundant. 

It successfully started on tank head pressure 
autogenous system will give normal operation. 
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SYSTEM FAILURE 
FULL PARTIAL 

X X 


X 


X 


X 


X 


X 


Uncertain 


X 


Uncertain 



OTV DUAL PROPELLANT EXPANDER CYCLE ENGINE 
FAILURE MODES AND EFFECTS ANALYSIS 

COMPONENT OR 


SUBSYSTEM 


FAILURE MODE 


SYSTEM EFFECT 

High Pressure Pump 
Discharge Line{s) 

1 . 

Leaks or cracks at lines, seals, or 
joints. 

1 . 

Engine operates off MR. Lowr thrust and Isp 

Hydrogen system only 

2. 

Catastrophic structural failure or 
rupture. 

2. 

Engine fails to opeate due to insufficient fuel. 

Oxygen system only 

3. 

Catastrophic structural failure. 

3. 

Possible fire, low order explosion. 

Igniter System 

1 . 

1 unit fails to operate. 

1 . 

No effect - fully redundant system. 

(Dual-redundant spark gap 
type elements. Inductive 

2. 

Both units fail to operate. 

2. 

No engine ignition. 

ignition coils, and electro- 
nics - may utilize hydrogen 
cooled ceramic element in 
lieu of igniter valves.) 

3. 

Spark delay on startup. 

3. 

Pressure spike and HM directed engine 
shutdown. 

Oxygen Turbine Bypass 
Valve 

1 . 

Valves fail to open, close, or 
partially operate; or response time 
out of limits. 

1 . 

Loss of throttling capability on affected engine. 
In multiple engine concept, other engines can 
gimbal and/or throttle to correct or null 
thrust vector. Health monitoring system can 
detect valve operational failure and adjust 
fuel throttling valve(s) to prevent catastrophic 
MR and resulting TCA damage. 


2. 

Valve surfaces have rubbing 
contact or fretting. 

2. 

Possible ignition depending on magnitude and 
duration of friction. HM directed engine shut- 
down. 


SYSTEM 

FULL 


X 

X 


X 

X 


X 


I 


I 


Page 3 of 6 
FAILURE 
PARTIAL 

X 


X 


TBD 


i i 


I I I I I 


COMPONENT OR 
SUBSYSTEM 


Hyrogen Turbine 


0 

1 

cn 


Thrust Chamber 
Assembly 


OTV DUAL PROPELLANT EXPANDER CYCLE ENGINE 
FAILURE MODES AND EFFECTS ANALYSIS 


FAILURE MODE 
3. Valve has internal leakage. 

1 . Valve fails to open, close, or par- 
tially operate; or response time 
out of limits. 


2. Valve has internal and/or 
external leakage. 

3. Failure of valve actuating coil 
control. 

1 . Leaks or cracks on TCA inner walls. 

2 . Leaks or cracks on TCA outer walls. 


3 . Major rupture or substantial foreign 
object damage. 

4. Plugged cooling channels (contamin- 
ation). 


SYSTEM EFFECT 

3. Magnitude of leakage may affect throttling 
capability and MR. 

1 . Loss of throttling capability on affected engine. 
In multiple engine concept, other engines can 
gimbal and/or throttle to correct or null 
thrust vector. Health monitoring system can 
detect valve operational failure and adjust 
oxidizer bypass valve to prevent catastrophic 
MR and resulting TCA damage. 

2. Magnitude of leakage may affect throttling 
capability and MR, reduced Isp. 

3. No effect. Redundant operating coils/ controls. 

1. System may operate off MR, reduced thrust 
and Isp. 

2. System operates off MR, reduced thrust and 
Isp. Shutdown if leak detection system is 
installed. 

3 . Engine shutdown by HM system. 

4. May reduce engine life, otherwise no effect 
on performance. 
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COMPONENT OR 
SUBSYSTEM 


FAILURE MODE 


SYSTEM EFFECT 


Baffle Plate 


Injector 


Engine Controller/ 
Health Monitoring 
o System 

C " Concept A : 

Supervisory or limited 
control. 

Concept B : 

Full authority control 
(redundant multiple 
channel). 


1 . Bum through in outer wall. 

2 . Plugged cooling channels (con- 
tamination). 


1 . May affect MR, Isp depending on magnitude. 

2. May reduce baffle life - otherwise no effect on 
performance. 


1 . Plugged orifices (contamination). 


1 . HM system erroneously predicts 
engine/system, component 
degradation or failure. 

2. Controller fails to adjust engine 
operation based on actual (non- 
catastrophic fault). 


1. May affect MR, Isp, thrust. Worst case (loss 
of fuel film cooling) may result in reduced 
engine life (thermal limits exceeded) or 
could cause TCA bum through. HM 
directed shutdown. 

1. Engine operates at lower thrust, Isp, or 
off MR. May be directed to shutdown. 


2. Reduced engine life. May cause HM 
directed shutdown. 


3. Partial faiure of controller, or loss 
of instrumentation parameter. 


3 . No effect - controller is redundant 

channel, can synthesize missing parameter 
or substitute nominal performance value. 


4. Total failure of controller or instru- 
mentation group. 


4. Loss of engine operation. Propellant shut- 
off valves close. 
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Transducer 


Gimbal System 


Radiation Cooled 
o Nozzle 


Nozzle Retraction 
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1. Transducer fails totally, calibration 
shifts, or transducer gives incorrect 
readings and/or transients. 

1 . No effect - health monitoring system can 
synthesize parameter or substitute nominal 
performance value. Most transducers will 
be redundant dual element design; health 
monitoring system can "vote out” incorrect 
reading by reate-of-change transient computa- 
tions (transducer drop outs or erratic transients) 
and by coparison with other combustion trans- 
ducer parameters. 

No effect 

1 . Gimbal actuators fail to extend or 
retract, insufficient stroke, 
erratic operation or slew rate. 

1 . Unaffected engines (multiple engine scenario) 
can compensate by selective gimbaling or 
throttling to null or correct thrust vector. 

X 

1 . Bum throughs, coating cracks, 
structural damage from handling, 
foreign objects/ meteors. 

1 . Reduced thrust, Isp - otherwise no effect on 
engine system operation (throttling and/ or 
gimbal system can compensate at system 
(multiple engine) level in worst case. 
Possible local heating of aerobrake. 

X 

1. Fails to retract. 

1 . May prevent aerobraking. Jettison if 
system has that capability. 

TBD 

2. Fails in intermediate position. 

2. May prevent aerobraking. Jettison if 
system has that capability. 

TBD 

1. Fails to extend. 

1. Engine can be operated. No gimbal capa- 
bility. Some local heating of aerobrake. 

X 


Nozzle Extension 
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